Ap77 Privacy Policy – Data Protection in Brazil

1 Who We Are — The Data Controller

Ap77 (ap77.world) is the controller of the personal data collected and processed in connection with the sports betting and online casino platform available at ap77.world and on the ap77 mobile app. As the controller, ap77 determines the purposes and means of processing its users' personal data.

For the purposes of this Privacy Policy, "ap77", "we", or "platform" refers to the company responsible for operating the ap77.world website and all associated digital services, including Sports Betting (Brasileirão Série A, Copa Libertadores, Copa do Brasil, UEFA Champions League, UFC, and other covered sports), Live Casino, slots, VIP Program, and all other platform features.

The official contact channel for privacy and data protection matters is the email address contato@ap77.world. ap77 has appointed a Data Protection Officer (DPO), whose contact details are available in Section 13 of this Policy.

2 Personal Data We Collect

Ap77 collects users' personal data at different points during their interaction with the platform. Below are the categories of data collected and the context in which each is collected:

2.1 Data provided directly by the user at registration:

• Full legal name;
• CPF (Individual Taxpayer Registration);
• Date of birth;
• Email address;
• Mobile phone number;
• Full residential address (street, neighborhood, city, state, zip code).

2.2 Data collected for identity verification (KYC):

• Copy or photo of a government-issued photo ID (RG or CNH);
• Selfie for identity verification (when requested);
• Proof of address issued within the last 90 days;
• Proof of income source (for withdrawals above certain amounts, as required by regulation).

2.3 Financial and transaction data:

• Registered Pix key (CPF, email, phone number, or random key);
• Credit or debit card details (partially masked number, expiration date, and card network — the full card number is not stored by ap77, but by the payment processor);
• History of deposits, withdrawals, and bets placed on the platform;
• Bank account details provided for wire transfers (bank, branch, and account number).

2.4 Platform usage data (collected automatically):

• IP address and approximate geographic location;
• Browser or app type and version;
• Device operating system;
• Pages visited, time spent, and browsing flow;
• Device identifiers (device ID) in the case of the mobile app;
• Timestamped logs of platform access and actions performed.

3 How and Why We Use Your Data

Ap77 uses the personal data collected exclusively for the purposes described below. No data is used for purposes incompatible with those stated here without the user's renewed consent or another applicable legal basis:

• Account creation and management: your full name, CPF, email address, and phone number are required to create and maintain an active account on the platform, to confirm that each account belongs to a real person aged 18 or older, and to allow account recovery in the event of a lost password;
• Delivery of Sports Betting and casino services: your betting history and gaming preferences are used to display your personalized dashboard, calculate results, credit winnings to your balance, and generate your account statement;
• Payment processing: financial data (Pix key, card details via third-party processor) is required to process deposits via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED, and to securely execute withdrawals to the account holder;
• Identity verification and fraud prevention: KYC documents are reviewed to confirm you are who you say you are, prevent multiple account creation, block underage access, and meet anti-money laundering obligations (Law No. 9.613/1998 and COAF regulations);
• VIP Program: your cumulative betting volume is used to calculate and update your VIP level (Bronze, Silver, Gold, Platinum, or Diamond) and to credit your automatic weekly cashback;
• Account communications: email and phone number are used to send transaction confirmations, security alerts (such as sign-ins from unrecognized devices), notifications about promotions you are eligible for, and updates regarding changes to this Policy or the Terms and Conditions;
• Platform improvement: usage and browsing data are analyzed in aggregated, anonymized form to identify technical issues, understand usage patterns, and improve the platform experience;
• Compliance with legal obligations: ap77 retains financial transaction records and user identity information as required by applicable Brazilian legislation governing the betting and financial services sector.

4 Legal Basis for Data Processing

Under the LGPD (Law No. 13.709/2018), all personal data processing must have a specific legal basis. ap77 processes user data under the following legal grounds:

• Contract performance (art. 7, V of the LGPD): the data processing required to create and maintain your account, process bets, execute Pix and other payment methods, and operate the VIP Program is carried out on the basis of the contract entered into between the user and ap77 at registration;
• Compliance with a legal obligation (art. 7, II of the LGPD): data processing for identity verification (KYC), anti-money laundering compliance, and financial record retention is carried out to fulfill legal obligations applicable to ap77 as a betting platform operator in Brazil;
• Legitimate interest (art. 7, IX of the LGPD): the processing of usage and browsing data for fraud prevention, detection of anomalous behavior, and platform security improvements is carried out on the basis of ap77's legitimate interest and that of its users in maintaining a safe environment;
• Consent (art. 7, I of the LGPD): marketing communications and promotions are sent based on user consent, which may be withdrawn at any time without affecting access to any other services on the platform.

5 Data Sharing with Third Parties

Ap77 does not sell users' personal data to third parties for commercial purposes. Data sharing only occurs in the situations described below, all of which are necessary for service operation or compliance with legal obligations:

• Payment processors: the financial data required to process transactions via Pix, boleto, credit and debit card, PicPay, Mercado Pago, and TED is shared with the financial institutions and payment processors involved in each transaction. These partners operate under their own security and LGPD compliance standards;
• Identity verification providers: in some cases, KYC documents may be reviewed by third-party providers specializing in identity verification, contracted by ap77 and bound by confidentiality obligations and LGPD compliance requirements;
• Casino game providers: to operate the live casino games, ap77 uses providers such as Evolution Gaming, Pragmatic Play Live, and others. Data sharing with these providers is limited to what is strictly necessary for user authentication during the game session and does not include complete financial information;
• Competent authorities: ap77 may share data with law enforcement, judicial, tax, or regulatory authorities when required by law, court order, or applicable regulation. This includes reporting obligations to COAF under Law No. 9.613/1998;
• IT and infrastructure service providers: cloud hosting providers, transactional email services, and data analytics tools used by ap77 may have technical access to user data in order to deliver their respective services, always under contracts that include data protection clauses.

All third parties with whom ap77 shares personal data are selected based on security criteria and compliance with applicable data protection laws, and are bound by contractual confidentiality obligations.

6 Cookies and Tracking Technologies

Ap77 uses cookies and similar technologies to ensure the platform works correctly, personalize the user experience, and analyze service performance. The types of cookies used are:

• Essential cookies: required for the platform's basic operation, such as keeping your session authenticated, remembering language preferences, and securing transactions. These cookies cannot be disabled without affecting your ability to use the platform;
• Performance cookies: collect anonymous information about how users navigate the platform — which pages are visited most, how much time is spent in each section, and what technical errors occur. This data is used solely to improve the experience;
• Functionality cookies: store choices made by the user, such as a favorite sport (Brasileirão, Libertadores, UFC) or preferred odds display format, to personalize the experience on future visits;
• Game session cookies: required to maintain the state of an active live casino or live betting session, ensuring continuity in the event of a brief connection interruption.

The ap77 mobile app uses device identifiers (device ID) that function similarly to cookies to maintain authenticated sessions and personalize your experience. You can manage app permissions in your Android or iOS device settings.

7 Data Security

Ap77 implements technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, or improper disclosure. The key measures in place include:

• SSL/TLS 256-bit Encryption: all communications between your device and ap77's servers are encrypted. This protects login credentials, financial transactions via Pix, and all information transmitted while using the platform;
• Two-factor authentication (2FA): available to all users and required for withdrawals above certain amounts. 2FA adds an extra layer of protection beyond your password;
• Secure password storage: passwords are stored in hashed and salted format using modern algorithms — ap77 has no access to your password in plain text;
• Access monitoring: automated systems monitor suspicious access attempts and block IPs exhibiting anomalous behavior. Sign-ins from new devices trigger email alerts;
• Financial data segregation: full credit card details are not stored on ap77's servers — processing is handled directly by a certified payment processor (PCI DSS);
• Internal access controls: only ap77 employees with a specific business need have access to users' personal data, and all such access is logged and audited.

In the event of a security incident that may affect data subjects' rights, ap77 will notify the National Data Protection Authority (ANPD) and the affected users within the timeframes and in the manner established by the LGPD.

8 How Long We Retain Your Data

Ap77 retains users' personal data for as long as necessary to fulfill the purposes stated in this Policy and to meet applicable legal obligations. The criteria used to determine retention periods include:

• Active account data: retained for as long as the account remains active on the platform, plus the time needed to resolve any disputes and fulfill post-closure legal obligations;
• Financial transaction records: retained for a minimum of 5 (five) years after the transaction is completed, as required by anti-money laundering legislation (Lei nº 9.613/1998) and Brazilian tax regulations;
• KYC documents: retained for a minimum of 5 (five) years after account closure, in accordance with applicable regulatory obligations;
• Access and security logs: retained for a minimum of 6 (six) months, as required by the Brazilian Internet Civil Framework (Lei nº 12.965/2014);
• Marketing data (with consent): retained until the user unsubscribes or withdraws consent.

Once the applicable retention period expires, data is securely deleted or anonymized in a way that prevents identification of the data subject. Anonymization follows technical standards that make re-identification of the data practically impossible.

9 Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, a set of rights that can be exercised at any time by submitting a request through ap77's privacy channel. Your rights are:

• Confirmation and access (Art. 18, I and II): you may request confirmation of whether ap77 processes your personal data and, if so, obtain access to that data in a readable format;
• Correction (art. 18, III): you may request the correction of incomplete, inaccurate, or outdated data. For certain fields (such as CPF and date of birth), corrections may require supporting documentation;
• Anonymization, blocking, or deletion (Art. 18, IV): you may request the anonymization, blocking, or deletion of unnecessary data or data processed in violation of the LGPD. Note that data required to fulfill legal obligations cannot be deleted before the mandatory minimum retention period;
• Portability (Art. 18, V): you may request the portability of your personal data to another service or product provider, in accordance with ANPD regulations;
• Deletion of data processed under consent (art. 18, VI): you may request the deletion of data processed based on your consent, such as data used for marketing communications, at any time;
• Information on sharing (art. 18, VII): you may request information about the entities with whom ap77 has shared your data;
• Consent information (art. 18, VIII): you may request information about the option to withhold consent and the consequences of doing so;
• Withdrawal of consent (art. 18, IX): you may withdraw your consent at any time, without affecting any other contractual obligations currently in effect.

To exercise any of these rights, submit a request to contato@ap77.world with the subject line "LGPD Rights – [your right]" and your full identification (name and CPF). ap77 will respond within 15 (fifteen) calendar days, as established by the LGPD. If a request is denied, ap77 will provide the reasons.

10 Minors

Ap77's services are intended exclusively for individuals aged 18 (eighteen) or older. ap77 does not intentionally collect personal data from minors and adopts technical and procedural measures to verify the age of users at registration and throughout the KYC process.

If you are the legal guardian of a minor and become aware that they have created an account on ap77 or provided personal data to the platform without authorization, please contact us immediately at contato@ap77.world. ap77 will take the following steps as soon as it is notified:

• Immediate account suspension;
• Preventive blocking of all balances;
• Deletion of the minor's personal data, unless retention is required to fulfill a legal obligation;
• Refund of any deposits made, with proof of lawful origin of funds.

11 International Data Transfers

Due to the nature of online betting services and the use of global-level technology providers, some personal data of ap77 users may be transferred to or accessed from countries outside Brazil. This can occur, for example, when live casino services are delivered by international providers such as Evolution Gaming and Pragmatic Play Live, or when cloud infrastructure is used.

Ap77 adopts the following measures to ensure that international data transfers maintain an adequate level of protection, in accordance with LGPD requirements:

• Contracts with standard data protection clauses with all international vendors that process data of Brazilian users;
• Preference for vendors located in countries whose data protection legislation is recognized by the ANPD as equivalent;
• Periodic review of the data protection practices of critical international suppliers.

12 Changes to this Privacy Policy

Ap77 may update this Privacy Policy periodically to reflect changes in the services offered, updates to data protection legislation, or improvements to internal privacy practices. Any material changes will be communicated to users via their registered email and through an in-platform notification at least 7 (seven) days before taking effect.

The most current version of this Policy is always available at ap77.world/privacy-policy, with the date of the last update shown at the top of the document. We recommend reviewing this Policy periodically to stay informed about how your data is handled.

Continued use of the ap77 platform after any changes to this Policy take effect constitutes acceptance of the updated terms. If you do not agree with the changes, you may exercise your right to request account closure and data deletion as set out in Section 9.

13 Contact — Privacy Channel & DPO

To exercise your data subject rights, ask questions about this Policy, or submit privacy-related suggestions to ap77, please use the channels below:

• Privacy channel email: contato@ap77.world — use the subject line "LGPD Rights" for formal rights requests;
• Live chat: available on the ap77 platform 24 hours a day — for general privacy and data protection inquiries;
• WhatsApp: available to Gold VIP members and above, through the dedicated account manager channel.

Ap77's Data Protection Officer (DPO) is the official point of contact with the National Data Protection Authority (ANPD) and with data subjects on matters related to the LGPD. Requests addressed to the DPO should be sent to contato@ap77.world with the subject line "DPO – [subject of request]".