22games Privacy Policy – Your Data, Protected

For the purposes of this Privacy Policy and the LGPD, the Controller of your personal data is the platform 22games, operated in https://22games.best.

The 22games is an entertainment, Sports Betting, and online casino platform developed and operated for the Brazilian market. All privacy and data protection inquiries can be directed to our official channel:

This Policy applies to all registered users of the 22games, unregistered site visitors, and anyone whose data is processed as a result of using the platform or interacting with support channels.

The 22games collects only the data necessary to operate the platform, meet legal obligations, and deliver the best experience to Brazilian users. The categories of data processed are outlined below:

The 22games does not collect sensitive data (such as racial origin, religious belief, political opinion, health information, sexual life, or biometric data) except where required by law or where the user voluntarily provides it for identity verification purposes.

The collection of personal data by 22games takes place through the following channels:

• Registration form: when you create an account on the platform, providing your name, CPF, email address, and phone number;
• KYC process: when we request identity verification documents, such as a national ID (RG), driver's license (CNH), or proof of address;
• Financial transactions: when making deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, or bank transfer (TED), payment data is recorded for financial control and regulatory compliance;
• Platform usage: automatically, through cookies, server logs, and similar technologies, whenever you browse 22games — whether on desktop or mobile;
• Communications: when you contact support via live chat, email, or any other official 22games channel;
• VIP Program: score, level, and benefit data are automatically generated based on your betting activity on the platform.

The 22games uses your personal data solely for the purposes described below. We never use your data for purposes incompatible with those stated in this Policy:

• Account creation and management: verify your identity, create and maintain your active profile on the platform, process registration, and authenticate access;
• Transaction processing: receive deposits, process withdrawals via Pix, maintain financial records, and fulfill applicable tax and regulatory obligations;
• Service provision: place sports bets on football (Brasileirão, Copa do Brasil, Libertadores), volleyball, MMA/UFC, basketball, and other sports; access Live Casino, crash games, poker, roulette, blackjack, and slots;
• Fraud Prevention and Money Laundering: analyze behavioral patterns to detect and prevent suspicious activity, in compliance with anti-money laundering legal obligations (Law No. 9.613/1998);
• VIP Program: calculate points, determine levels, automatically credit cashback and rake-back, and offer personalized benefits;
• Customer Support: answer questions, resolve technical issues, handle complaints, and improve service quality;
• Service communications: send notifications about transactions, important account updates, security alerts, and changes to the Terms or this Policy;
• Marketing communications: send offers, promotions, and news from 22games — only to users who have consented to this type of communication, with the option to unsubscribe at any time;
• Platform improvement: analyze aggregated and anonymized usage data to improve the experience, identify bugs, and develop new features;
• Legal compliance: comply with requests from judicial, regulatory, or government authorities when legally required.

All personal data processing by 22games is grounded in at least one of the legal bases set out in article 7 of the LGPD. The applicable basis for each purpose is:

• Contract performance (art. 7, V): account creation and management, processing financial transactions, providing Sports Betting and casino services, VIP Program — activities required to fulfill the service agreement entered into at the time of registration;
• Compliance with a legal obligation (Art. 7, II): identity verification (KYC), anti-money laundering compliance, retention of financial records for the legally required period, compliance with judicial and regulatory orders;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, behavioral analysis for abuse detection, and continuous service improvement — always balanced against the rights and reasonable expectations of data subjects;
• Consent (art. 7, I): sending marketing communications, use of non-essential cookies, collection of data for advanced personalization — with the option to withdraw consent at any time without affecting access to your account.

The 22games does not sell your personal data. Sharing with third parties occurs only in the strictly necessary cases listed below, always under contractual confidentiality and security clauses:

• Payment processors: partners such as Pix (Banco Central), credit/debit card operators, PicPay, and Mercado Pago receive only the minimum data necessary to process transactions in BRL. These partners have their own privacy policies and are responsible for data handling within their systems;
• Identity verification providers (KYC): companies specializing in document and CPF validation with the Federal Revenue Service (Receita Federal), used in the identity verification process for regulatory compliance;
• Casino game providers: providers of roulette, blackjack, crash games, slots, and live casino games receive the technical session data needed to operate those games. No sensitive financial data is shared;
• IT infrastructure providers: cloud, hosting, and database services that operate 22games servers, contracted with data processing clauses in accordance with the LGPD;
• Public authorities: when required by law, court order, or request from the Ministério Público, Banco Central, Secretaria da Receita Federal, or other competent Brazilian authorities.

The 22games requires all its suppliers and partners to handle users' personal data with the same level of protection demanded by the LGPD, and conducts periodic compliance assessments.

Some of the infrastructure and service providers used by 22games may be located outside Brazil. When this occurs, international data transfers are carried out with the safeguards required by Art. 33 of the LGPD, including:

• Transfer to countries with an adequate level of protection recognized by the ANPD;
• Execution of standard contractual clauses for data protection with the foreign recipient;
• Adoption of global corporate data protection policies (BCRs) when the recipient is part of a corporate group with consolidated policies.

Under no circumstances will your data be transferred to countries that do not provide adequate protection guarantees in accordance with LGPD standards and ANPD regulations.

The 22games retains your personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law:

• Active account data: for as long as the account remains active or for as long as necessary to provide the contracted services;
• Financial data (deposits, withdrawals, transaction history): a minimum of 5 years after the transaction, in accordance with tax and regulatory obligations (Law No. 9.613/1998 — anti-money laundering);
• Betting records and gaming session logs: a minimum of 3 years for audit purposes and regulatory compliance in the Sports Betting sector (Law No. 14.790/2023);
• Access logs (IP, device, timestamp): a minimum of 6 months, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12.965/2014);
• Support and communications data: 2 years after the ticket or interaction is closed;
• Closed account data: upon voluntary account closure, data is anonymized or deleted within 90 days, unless a longer legal retention obligation applies.

The 22games applies robust technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or improper disclosure:

• SSL/TLS encryption: all communication between your browser or mobile device and 22games' servers is encrypted using up-to-date SSL/TLS protocols;
• Encrypted storage: sensitive data — such as CPF and payment information — is stored in encrypted form in the platform's databases;
• Access control: only employees with a legitimate need can access personal data, with mandatory multi-factor authentication and full access audit logging;
• Continuous monitoring: intrusion detection systems and behavioral analysis tools operate around the clock to identify and respond to threats in real time;
• Security testing: the platform undergoes periodic penetration testing conducted by independent specialized firms;
• Incident response plan: in the event of a data breach that may affect data subjects, 22games will notify the ANPD and the affected users within the legally required timeframes, as set out in Art. 48 of the LGPD.

Despite all measures in place, no system is 100% immune to breaches. The 22games recommends using strong, unique passwords for your account, enabling two-factor authentication when available, and never sharing your login credentials with third parties.

The 22games uses cookies and similar technologies to enhance your experience on the platform. See the types used:

• Essential  Required for basic functionality — session authentication, betting slip, language preferences. These cannot be disabled as the platform cannot operate without them.
• Analytics  Collect anonymized data about how you use the platform — pages visited, session duration, errors encountered. Used to improve 22games performance.
• Functional  Remember your preferences — such as odds format (decimal, American, or fractional), preferred layout, and notification settings — to personalize your experience.
• Security  They detect suspicious behavior, unusual login attempts, and potentially fraudulent activity to keep your account safe.

You can manage non-essential cookie preferences through the cookie banner shown on your first visit to the site, or through your browser settings. Disabling essential cookies may affect how the platform functions.

The services of the 22games are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect, process, or store personal data from users under 18.

Registration on 22games requires a valid date of birth and CPF, and includes verification steps to ensure only adults can access the platform. If the 22games identifies that data from a user under 18 has been collected, that information will be immediately deleted and the account will be closed.

To exercise any of your rights as a data subject (access, correction, deletion, portability, objection, or withdrawal of consent), please contact the 22games through the channels below:

• Email: suporte@22games.best — please include "LGPD Request" in the subject line;
• Live Chat: available 24 hours a day directly on the platform, accessible after login;
• Account form: the "Privacy & Data" section in your account dashboard allows you to submit certain requests directly, such as updating your registration details.

For security purposes, the 22games may request identity confirmation before processing sensitive requests (such as data deletion or portability). We will respond within 15 calendar days of receiving the complete request.

If you are not satisfied with the response from 22games, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), as provided under art. 18, sole paragraph, of the LGPD.

Pursuant to Art. 41 of the LGPD, the 22games has appointed a Data Protection Officer (DPO) responsible for:

• Receive complaints and communications from data subjects;
• Address inquiries and take action regarding personal data processing;
• Receive communications from the Autoridade Nacional de Proteção de Dados (ANPD);
• Train platform staff and contractors on personal data protection practices;
• Oversee 22games's compliance with this Policy and its obligations under the LGPD.

The 22games may update this Privacy Policy periodically to reflect changes in data processing practices, new legal obligations, or improvements to our services. When material changes are made, you will be notified via:

• Prominent notification on the platform at the time of your next login;
• Email to the address registered on your account;
• Update of the "Last updated" date at the top of this page.

Continued use of the platform after changes take effect constitutes acceptance of the updated Policy. We recommend reviewing this Policy periodically to stay informed about how the 22games protects your data.

For changes involving fundamental shifts in processing purposes or data sharing, the 22games will request new express consent before initiating any new processing activity where consent is the applicable legal basis.