999h Privacy Policy – Your Data Always Protected

A 999h is the Sports Betting and online entertainment platform available at 999h.click, operated and managed with an exclusive focus on the Brazilian market. For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), the 999h acts as the controller of its users' personal data, responsible for decisions regarding the processing of that data.

This Privacy Policy clearly and objectively describes how 999h collects, uses, stores, shares, and protects the personal data of all platform users — whether sports bettors, Live Casino players, VIP Program members, or simply site visitors.

If you have any questions about this policy or wish to exercise any of your rights as a data subject, please contact our Data Protection Officer (DPO) at privacidade@999h.click or reach our customer support team, available 24 hours a day via the platform's live chat.

A 999h collects different categories of data depending on how you interact with the platform. Below is a clear overview of each data type and when it is collected:

A 999h does not collect or process sensitive personal data such as racial origin, sexual orientation, religious beliefs, or health data, except in specific situations where strictly necessary for responsible gaming purposes and with the user's explicit consent.

The personal data collected by 999h are used solely for the purposes described below. No data is used for purposes not covered by this policy without prior notice and, where applicable, renewed user consent:

• Account operation: creation, maintenance, and security of your 999h account, including login authentication and password recovery.
• Payment processing: processing of deposits via Pix, boleto bancário, credit and debit card, Mercado Pago, and PicPay, and of withdrawals to bank accounts in BRL.
• Service delivery: operation of Sports Betting (Brasileirão, Copa do Brasil, Libertadores, UFC, NBB, etc.), Live Casino, crash games, and the VIP Program.
• Identity verification (KYC): compliance with regulatory obligations for anti-money laundering and age verification (18 years old).
• Customer support: handling requests, resolving issues, and responding to complaints via chat and email, 24 hours a day.
• Responsible gambling: monitoring of behavioral patterns that may indicate problem gambling, with the goal of proactively supporting the user.
• Communications: sending notifications about transactions, Brasileirão promotions, VIP Program updates, and platform news — always with the option to unsubscribe.
• Security and fraud prevention: detection of suspicious activity, multiple accounts, and attempts to abuse 999h promotions.
• Platform improvement: aggregated and anonymized analysis of user behavior to improve the 999h experience.

Every data processing operation carried out by 999h is grounded in a legal basis provided for under the LGPD. The use of appropriate legal bases is what distinguishes legitimate data processing from the arbitrary use of personal information.

• Contract performance (Art. 7, V of the LGPD): most data processing at 999h takes place because it is necessary to deliver the services contracted by the user when creating an account and placing bets or playing.
• Legal obligation (Art. 7, II of the LGPD): KYC identity verification, anti-money laundering compliance, and enforcement of court orders follow obligations imposed by Brazilian law on 999h as an entertainment platform operator.
• Legitimate interest (Art. 7, IX of the LGPD): fraud detection, prevention of promotional abuse, and internal analysis to improve 999h's services.
• Consent (Art. 7, I of the LGPD): marketing communications, promotional notifications, and collection of data not essential to operations, where users may withdraw consent at any time without affecting their use of the platform.

A 999h does not sell, rent, or transfer users' personal data to third parties for any commercial or advertising purposes. Data sharing occurs only in the situations listed below, and always under active data protection agreements with the partners involved.

• Payment processors: only the minimum necessary data is shared with Pix, bank slip, credit and debit card, Mercado Pago, and PicPay operators, solely to process transactions requested by the user.
• Live game providers: to operate the 999h Live Casino, session data is shared with providers such as Evolution Gaming and Pragmatic Play Live, under the terms of agreements entered into with 999h.
• Identity verification services: during the KYC process, documents may be processed by specialized verification tools contracted by 999h, subject to confidentiality agreements.
• Regulatory and judicial authorities: 999h may disclose personal data in response to lawful requests from competent Brazilian authorities, as required by law, court order, or applicable regulatory proceedings.
• Technology infrastructure providers: hosting services, network security, and fraud analysis used by 999h have restricted, monitored access limited to the data required for their specific function.

A 999h retains personal data only for as long as necessary for the purposes for which it was collected, or to meet legal and regulatory obligations applicable to the platform in Brazil.

• Registration and KYC data: retained for as long as the account remains active and, after closure, for at least 5 years for compliance purposes under Brazilian anti-money laundering legislation.
• Financial transaction history: deposits via Pix, withdrawals, and account transactions are retained for a minimum of 5 years after the transaction date, in accordance with fiscal and regulatory requirements.
• Betting and gaming history: retained for up to 5 years for support, dispute resolution, and regulatory compliance purposes.
• Support communication data: support history retained for up to 2 years to ensure continuity and quality of service.
• Technical and browsing data: access logs and session data are retained for up to 12 months for security and fraud detection purposes.

Once the applicable retention periods have expired, data is permanently deleted or irreversibly anonymized, making any future identification of the user impossible.

A 999h implements robust technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, or improper disclosure. Key safeguards include:

• Encryption in transit: all communication between the user and 999h's servers uses the TLS protocol with 256-bit SSL encryption — the same standard applied by the Brazilian banking system.
• Encryption at rest: sensitive data stored on 999h servers is encrypted, ensuring protection even in the event of unauthorized physical access to the systems.
• Internal access control: only staff with a verified operational need have access to users' personal data, with multi-factor authentication and an audit trail recorded for every access.
• Continuous monitoring: automated intrusion detection and anomalous behavior systems operate around the clock to identify and block threats in real time.
• Periodic security testing: 999h conducts regular vulnerability assessments and penetration tests carried out by external specialists to identify and fix weaknesses before they can be exploited.

In the event of a security incident that may compromise users' personal data, 999h will follow the procedures set out in the LGPD, including notifying the National Data Protection Authority (ANPD) and affected users within the applicable legal deadlines.

A 999h uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and analyze service performance. See the types used:

• Essential cookies: required for the basic operation of the platform — session authentication, account balance management, and login security. They cannot be disabled without impairing your use of the platform.
• Performance cookies: collect aggregated and anonymous information about how users navigate 999h — which sections are most visited, average session duration — to identify interface improvements.
• Functional cookies: remember user preferences such as language, betting settings, and notification preferences to personalize the platform experience.
• Security cookies: detect suspicious behavior such as multiple simultaneous logins, access attempts from unusual locations, and patterns associated with fraud.

You can manage non-essential cookie settings through the preferences menu available on the platform. Removing essential cookies may prevent your account from functioning correctly on 999h.

The LGPD guarantees you, as the owner of the personal data processed by 999h, a set of rights you can exercise at any time. See each one and how to use them:

The services of 999h are intended exclusively for users aged 18 and over. The platform does not knowingly collect personal data from minors and expressly prohibits registration and use by anyone under that age.

During registration, the user confirms they have reached the legal age. The KYC verification process confirms actual age through identity documents. Should 999h identifies that an account was created by a minor, it will be closed immediately, all balances will be returned to the original payment method, and the minor's data will be deleted from our systems.

If you suspect that a minor is using the platform, please contact our support team immediately at privacidade@999h.click so we can take the necessary action.

In some cases, the personal data of users of 999h may be processed or stored on servers located outside Brazil — for example, when using services from international live game providers such as Evolution Gaming, which operates studios across multiple countries.

All international data transfers carried out by 999h comply with the LGPD provisions on international data transfers, including the requirement that the destination country offers an adequate level of data protection or that the transfer is supported by standard contractual clauses ensuring the same rights and protections provided under Brazilian law.

A 999h may periodically update this Privacy Policy to reflect changes in Brazilian legislation — especially ANPD regulations — new services offered on the platform, or adjustments to internal data processing procedures.

Any significant changes will be communicated via email to the registered address at least 15 days in advance before taking effect. The last updated date at the top of this page will always be revised accordingly. Continued use of the platform after changes take effect constitutes acceptance of the new terms.

For changes that involve new data processing or that require new consent, the 999h will request explicit user confirmation before initiating any new processing.

A 999h has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO is the official point of contact for all privacy and data protection requests:

• DPO email: privacidade@999h.click
• 24h general support: suporte@999h.click
• Live chat: available 24 hours a day directly on the 999h platform

All requests related to your rights as a data owner — access, correction, deletion, portability, consent withdrawal — must be submitted through the channels above. The 999h will respond within the timeframes established by the LGPD, generally within 15 business days for requests that require more detailed review.

If you believe your right to privacy has been violated by 999h and did not receive a satisfactory response from our support team, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the federal authority responsible for overseeing LGPD compliance in Brazil.