Privacy Policy 777s – Your Data Protected

1. Who We Are – The Data Controller

A 777s is the controller of personal data collected through the 777s.cash platform. Under the LGPD, the controller is the entity that determines the purposes and means of processing personal data. By creating an account and using the services of 777s, you provide personal data that will be processed under the platform's responsibility, as described in this Policy.

For any questions regarding the processing of your personal data, the dedicated contact channel is suporte@777s.cash, with the subject line "LGPD – Solicitação de Titular". Our data protection team responds within 15 business days as required by law.

2. What Data We Collect

A 777s collects personal data at different points in your journey on the platform. The table below summarizes the main data categories and when they are collected:

Data We Do Not Collect

A 777s does not collect sensitive data such as racial or ethnic origin, religious beliefs, health information, sexual orientation, or biometric data — except for a selfie with a document used solely for identity verification when required by the KYC process. This limited biometric data is used only to confirm that the account holder is the same person shown in the submitted document.

3. How We Use Your Data

The personal data collected by the 777s have specific and limited purposes. No data is collected "just in case" or stored without a clear purpose. The main purposes are:

• Account creation and management: verify your identity, create your platform profile, and keep your registration details up to date;
• Transaction processing: process deposits via Pix, credit/debit card, PicPay, Mercado Pago, TED, or boleto bancário, and process withdrawals via Pix;
• Identity Verification (KYC): comply with legal anti-money laundering obligations and age verification (18+);
• Service delivery: ensure the proper functioning of Sports Betting, Live Casino, slots, and other games;
• Security and fraud prevention: identify and block suspicious activity, multiple accounts, and platform misuse;
• Communication: send notifications about your account, withdrawals, relevant promotions, and platform updates (with the option to unsubscribe at any time);
• Personalization: tailor the platform experience based on your gaming preferences and activity history;
• Customer support: resolve questions, disputes, and requests related to your account;
• Legal compliance: comply with obligations imposed by Brazilian law, including the LGPD and the regulations of the Central Bank of Brazil.

4. Legal Basis for Processing (LGPD)

The LGPD requires that all personal data processing be grounded in one of the legal bases set out in Article 7 of the law. The 777s bases the processing of your data on the following legal grounds:

• Contract performance (art. 7, V): processing is necessary to perform the contract between you and 777s – that is, to allow you to create an account, deposit, place bets, and withdraw. Without this data, the service simply cannot function;
• Compliance with a legal obligation (art. 7, II): identity verification, anti-money laundering measures, and compliance with Central Bank of Brazil regulations require the processing of certain data regardless of your consent;
• Legitimate interest (art. 7, IX): platform security, fraud prevention, and continuous service improvement are processed on the basis of 777s's legitimate interest, always balanced against your rights;
• Consent (art. 7, I): for sending marketing communications and promotions, the legal basis is your express consent, which can be withdrawn at any time in your account settings or by emailing suporte@777s.cash.

5. Sharing Data with Third Parties

A 777s does not sell, rent, or trade users' personal data. Data is shared with third parties only in the following specific and necessary situations:

• Payment providers: financial institutions and payment systems (Pix via Banco Central, card operators, PicPay, Mercado Pago) receive only the data strictly necessary to process each transaction;
• Identity verification (KYC) providers: specialized partners in compliance and fraud prevention may receive identification data to process verification. These partners operate under confidentiality agreements and receive only the data necessary for that purpose;
• Game providers: live casino and slots providers receive technical session data (anonymized user ID) required for the operation of live tables and games;
• Technology infrastructure services: hosting, cloud storage, and cybersecurity providers that support platform operations, all under data processing agreements compliant with the LGPD;
• Competent authorities: when required by court order, regulatory directive from the Central Bank of Brazil, or another legal obligation, the necessary data will be provided to the competent authorities. 777s will notify the user of such requests whenever legally permitted.

All third parties that receive personal data from users of the 777s are bound by contracts requiring data processing in compliance with the LGPD and security standards equivalent to those adopted by the platform.

6. How Long We Keep Your Data

A 777s retains personal data for the minimum period necessary to fulfill the purposes described in this Policy and applicable legal obligations. The main criteria that determine retention periods are:

• Identification and registration data: retained for the duration of the account and for up to 5 years after closure, in accordance with legal requirements for anti-money laundering and tax obligations;
• Financial transaction history: retained for 5 years after each transaction, as required by the Central Bank of Brazil and tax legislation;
• Platform activity data (bets, games): retained for as long as the account is active and for 2 years after closure;
• Support communications: retained for 2 years from each interaction;
• Technical data (IP, access logs): retained for 6 months in accordance with the Brazilian Internet Civil Framework (Law No. 12,965/2014).

Once retention periods expire, data is securely deleted or irreversibly anonymized. Anonymized data may be retained for statistical purposes and platform improvement, as it no longer allows identification of the data subject.

7. How We Protect Your Data

A 777s implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, accidental loss, alteration, improper disclosure, or destruction. The key security measures in place include:

• SSL/TLS 256-bit encryption across all communication between your device and the platform's servers;
• Two-factor authentication (2FA) available as an additional security layer for login;
• Encrypted storage of sensitive data such as passwords (salted hash) and identity documents;
• Role-based access control (RBAC): 777s employees only access the data required for their specific roles;
• Continuous monitoring of suspicious activity and unauthorized access attempts;
• Regular security testing, including vulnerability assessments and penetration testing carried out by specialized teams;
• Incident response plan documented, with a notification protocol to the National Data Protection Authority (ANPD) and affected users in the event of a data breach.

Despite every effort, no security system is 100% foolproof. The 777s commits to notifying affected users and the ANPD in the event of a security incident that may affect your personal data, within the timeframe required by the LGPD.

8. Cookies and Tracking Technologies

A 777s uses cookies and similar technologies to ensure the platform operates correctly, personalize your experience, and analyze how services are used. When you first access the platform, you will see a cookie consent banner where you can manage your preferences. Below are the types of cookies used:

You can manage, block, or delete cookies at any time through your browser settings. Keep in mind that blocking all cookies may affect basic platform functionality, such as keeping your session active while you play.

9. Your Rights as a Data Subject

The LGPD grants you, as the data subject whose personal data is processed by 777s, a set of rights that can be exercised at any time. Here is what you can request:

• Access (art. 18, I): request confirmation that your data is being processed and obtain a copy of the data 777s holds about you;
• Correction (art. 18, III): request the correction of incomplete, inaccurate, or outdated data;
• Anonymization or deletion (art. 18, IV): request the anonymization or deletion of unnecessary data or data processed in violation of the LGPD. Data required to fulfill legal obligations cannot be deleted before the applicable legal retention periods expire;
• Portability (art. 18, V): request the portability of your data to another platform or service, in a structured and interoperable format;
• Consent withdrawal (art. 18, IX): withdraw consent previously given for data processing based on that legal ground (such as receiving marketing communications), without affecting the lawfulness of any processing carried out before the withdrawal;
• Sharing disclosure (art. 18, VII): request information about which public and private entities 777s has shared your data with;
• Review of automated decisions (art. 20): request human review of automated decisions that affect your interests on the platform.

To exercise any of these rights, contact us at suporte@777s.cash with the subject line "LGPD – Solicitação de Titular", stating the right you wish to exercise and your CPF registered on the platform. 777s will respond within up to 15 business days, as required by the LGPD.

10. Minors

A 777s is a platform exclusively for users aged 18 and over. Age verification is mandatory during registration, with CPF and identity document checks. The platform does not intentionally collect personal data from anyone under 18.

If we identify that data from a minor was inadvertently collected, that data will be deleted immediately and the account will be closed. If you are aware that someone under 18 has created an account on 777s, please contact us at suporte@777s.cash so the matter can be handled with the urgency it requires.

11. International Data Transfers

Some of the technology partners of 777s — such as cloud infrastructure providers and Live Casino game suppliers — may be located outside Brazil. Any international transfer of personal data is only carried out when:

• The destination country offers an adequate level of personal data protection, as recognized by the ANPD; or
• The transfer is carried out on the basis of standard contractual clauses that guarantee the data subject the same rights protected under the LGPD; or
• The data subject has given explicit consent to the transfer, having been duly informed of the risks involved.

A 777s regularly maps cross-border data flows and ensures that appropriate contracts are in place with all international partners that process data from Brazilian users.

12. Changes to This Privacy Policy

A 777s may update this Privacy Policy periodically to reflect changes in services, Brazilian legislation, or industry best practices. When significant changes are made, the platform will notify users via their registered email and/or a prominent login notice at least 7 days before the new version takes effect.

The date of the last update is shown at the top of this page. Continued use of the platform after the changes take effect constitutes acceptance of the updated Policy. If you do not agree with the changes, you may close your account as described in the Terms and Conditions.

13. Contact – Data Protection Officer (DPO)

A 777s has appointed a Data Protection Officer (DPO) responsible for overseeing LGPD compliance on the platform, acting as a communication channel with data subjects and with the National Data Protection Authority (ANPD).

To exercise your rights as a data subject, ask questions about this Policy, or file a complaint related to the processing of your personal data, please use the channels below:

• DPO Email: suporte@777s.cash – subject line: "LGPD – Data Subject Request"
• Live chat: available directly on the platform, 24 hours a day
• Response time: up to 15 business days as per art. 18 of the LGPD

For complaints not resolved directly with 777s, you may contact the National Data Protection Authority (ANPD) at gov.br/anpd.