13bet Privacy Policy — Your Data Protected under the LGPD

13bet is a Sports Betting and online casino platform operated for the Brazilian market, available at 13bet.life. In this Privacy Policy, when we say "13bet," "we," or "our platform," we are referring to the operator responsible for processing your personal data as described below.

This Privacy Policy clearly and directly explains how 13bet collects, uses, stores, shares, and protects the personal information of registered players and platform visitors. It applies to all services offered by 13bet, including Sports Betting on the Brasileirão, Copa do Brasil, Libertadores, SuperLiga de Vôlei, NBB, UFC, e-sports, and live casino, as well as all deposit processes via Pix, credit card, and other Brazilian payment methods.

13bet is committed to the principles of the Lei Geral de Proteção de Dados (Law nº 13.709/2018 — LGPD): purpose limitation, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability. This policy is the practical expression of that commitment.

13bet collects only the data necessary to operate the platform, meet legal obligations, and provide a safe, personalized experience. See the breakdown by category:

13bet does not collect sensitive data such as racial origin, religious beliefs, genetic or biometric data (beyond the KYC selfie), or health information. Credit card data is not stored directly by 13bet — that processing is handled by PCI-DSS certified payment gateways.

13bet uses your personal data exclusively for legitimate purposes directly related to the operation of the platform and compliance with legal obligations. These purposes are:

• Create and manage your account: use your CPF, name, email, and mobile number to create, authenticate, and securely maintain your 13bet account;
• Processing deposits and withdrawals: use your financial data and Pix key to process transactions securely, comply with Central Bank requirements, and meet anti-money laundering regulations;
• Verify your identity (KYC): verify that you are who you claim to be and that you are over 18 years old before releasing your first withdrawal, as required by industry regulations;
• Operating the services: record and settle bets on Brasileirão, SuperLiga, NBB, UFC, and live casino, calculate odds, process results, and apply the rules of the Terms and Conditions;
• Security and fraud prevention: use technical data (IP, device) and behavioral data to detect duplicate accounts, automation, bonus abuse, and other prohibited conduct;
• Player support: use account history to answer questions, resolve complaints, and improve customer support — all support interactions are logged for a period of 2 years;
• Transactional communications: send notifications about processed withdrawals, security alerts, and important platform updates;
• Marketing communications (optional): send promotions, bonuses, and news only if you have explicitly opted in to receive that type of communication;
• Compliance with legal obligations: retain financial and identity records for the minimum period required by the Receita Federal, the Banco Central, and other competent authorities.

The LGPD requires that all personal data processing have a specific legal basis. 13bet processes your data in accordance with the following grounds set out in Article 7 of Law No. 13,709/2018:

• Contract performance (Art. 7, V): processing is necessary to provide the services you signed up for when creating your account — handling bets, deposits, withdrawals, and casino use. Without this data, 13bet cannot deliver the service;
• Compliance with a legal or regulatory obligation (art. 7º, II): 13bet is required by law to retain identity records (KYC), financial transactions, and betting history to comply with the requirements of the Banco Central, the Receita Federal, and anti-money laundering regulations (Law nº 9.613/1998);
• Legitimate interest (Art. 7, IX): the use of technical data for fraud prevention, account security, and ongoing platform improvement is based on the legitimate interests of 13bet and its players, who benefit from a safer environment;
• Consent (art. 7º, I): marketing communications and promotions are sent exclusively based on your express consent, which can be withdrawn at any time.

13bet does not sell your data to third parties and only shares information when strictly necessary to operate the platform or meet legal obligations. Below are the circumstances in which sharing may occur:

• Payment processors: Certified payment gateways process transactions via Pix, credit/debit card, PicPay, and Mercado Pago. These partners receive only the minimum data required to complete the transaction and are contractually prohibited from using your data for any other purpose;
• Identity verification providers (KYC): companies specializing in document verification receive your ID and selfie to validate your identity. This data is processed for that specific purpose and is not retained by providers beyond what is necessary;
• Casino game providers: providers such as Pragmatic Play and Evolution receive an anonymous session identifier to operate games in real time. They do not receive your name, CPF, or banking details;
• Competent authorities: 13bet may share data with the Receita Federal, Banco Central, Ministério da Fazenda, or judicial authorities when required by law, court order, or formal regulatory request;
• IT service providers: companies providing cloud infrastructure, cybersecurity, and fraud analysis services have limited access to technical data for system maintenance purposes, under strict confidentiality agreements.

All data sharing with third parties is formalized through contracts containing data protection clauses that prohibit the use of your information for any purpose beyond what was agreed with 13bet.

13bet uses cookies and similar technologies to keep the platform running properly, protect your account, and improve your experience. We do not use aggressive third-party advertising trackers.

Types of cookies 13bet uses:

• Essential Cookies: required for you to log in, navigate between sections, keep your session active, and place bets. Without these cookies, the platform does not work. They cannot be disabled;
• Security cookies: detect suspicious login attempts, identify bots, and protect against brute-force attacks and identity fraud. They are an essential part of keeping your 13bet account secure;
• Performance cookies: measure page load times, identify technical errors, and help optimize platform speed — especially important for live betting with real-time odds;
• Preference cookies: remember your account settings, such as language and notification preferences, so you do not have to reconfigure them each time you log in;
• Analytics cookies: used internally to understand which features are most popular and where players encounter difficulties, based on aggregated and anonymized data.

You can manage your cookie preferences (except essential cookies) in your browser settings. Blocking non-essential cookies may affect some platform features, but will not prevent access to betting or the casino.

Data security at 13bet is not just a promise — it is a concrete technical and operational framework. Here are the layers of protection we apply:

• Encryption in transit: all communication between your device and 13bet's servers uses TLS 1.3 with SSL 256-bit certificates. This covers every click, every bet, and every financial transaction made on mobile or desktop;
• Encryption at rest: sensitive data stored in 13bet's databases — such as CPF, KYC documents, and payment information — is encrypted at rest using AES-256;
• Access controls: only 13bet employees with a verified operational need are granted access to identifiable personal data, and all such access is logged and regularly audited;
• Two-factor authentication: available and recommended for all players. Once enabled, it protects your account even if your password is compromised;
• Continuous monitoring: intrusion detection systems and anomaly monitoring operate 24 hours a day, identifying unauthorized access attempts;
• Security testing: 13bet's platform undergoes periodic penetration testing by specialized third-party firms to identify and remediate vulnerabilities before they can be exploited;
• Incident Response Plan: 13bet has a documented protocol for responding to security incidents, including notifying the National Data Protection Authority (ANPD) and affected players within the timeframes required by the LGPD.

Brazil's General Data Protection Law (LGPD) grants you, as the data subject, a set of rights that 13bet is committed to respecting and upholding. See each one below:

13bet follows the LGPD's necessity principle: your data is kept only for as long as needed for the stated purposes, or for the minimum period required by law. See the retention periods by category:

Once the applicable retention period expires, data is securely deleted from 13bet's systems, including backups, in accordance with internal data disposal procedures. Data that has been irreversibly anonymized is not subject to personal data retention periods.

13bet has appointed a Data Protection Officer (DPO) as required by the LGPD to oversee internal compliance with this policy and to serve as the point of contact for the exercise of data subject rights and communications with the National Data Protection Authority (ANPD).

To contact 13bet's DPO or privacy team:

Updates to this Privacy Policy: 13bet may periodically revise this policy to reflect changes in legislation, our practices, or the services we offer. When we make material changes that affect your rights, we will notify you by email and via an in-platform notification at least 15 days before the new terms take effect.

Wording changes that do not materially affect your rights may be published without a notice period. The date of the last update is always shown at the top of this document and in the page footer.

Version in effect: the version published on this page at 13bet.life/privacy-policy is always the current, in-force version of 13bet's Privacy Policy. Previous versions may be requested from the DPO at the email address above.