999mm Privacy Policy – Data Protection in Brazil

The 999mm is an online Sports Betting and entertainment platform designed exclusively for the Brazilian market. We operate the site 999mm.best and all associated services, including football betting (Brasileirão Série A, Copa do Brasil, Libertadores), MMA and UFC, e-sports, slots, live casino, and the VIP Program.

For the purposes of this Privacy Policy, 999mm acts as Data Controller as defined by the LGPD — meaning we are the party that decides how and why your personal data is collected and processed. When we engage service providers to process data on our behalf, such as payment processors and identity verification providers, these partners act as Data Processors and are contractually required to process your data only in accordance with our instructions and within the limits set by the LGPD.

This Policy applies to anyone who:

• Visit 999mm.best, even without creating an account.
• Create an account and start using any service on the platform.
• Reach out to our support team through any available channel.
• Receive marketing communications from 999mm after providing your consent.

This Policy does not apply to third-party websites or services that may be indirectly linked to the 999mm ecosystem. Each content provider, such as live game providers, has its own privacy policy.

999mm collects only the data necessary to provide platform services, verify user identity, and comply with legal obligations. The types of data we may collect are listed below, depending on how you use the platform:

We do not collect sensitive data as defined by the LGPD, such as health information, biometric data, political opinions, or religious beliefs. CPF is collected solely for identity verification and legal compliance purposes and is not used for anything beyond that.

Data collected by 999mm is used exclusively for the purposes described below. We do not use your data for any purpose not listed here without notifying you and, where required, obtaining fresh consent.

• Account creation and management: verify your identity, create your account, grant access to the platform, and save your preferences and settings.
• Service delivery: process Sports Betting on football, MMA, e-sports, and other markets, record and settle results, and manage account balance and history.
• Financial transactions: process deposits via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED transfer, as well as process withdrawals to bank accounts specified by the user.
• Eligibility verification: confirm that the user is 18 years of age or older, is a resident of Brazil, and is not on any active exclusion list.
• Fraud prevention and security: detect suspicious activity, protect platform integrity, investigate violations of the Terms and Conditions, and fulfill regulatory obligations related to anti-money laundering.
• Customer support: answer questions, resolve issues with bets or transactions, and keep a record of interactions to continuously improve our support.
• VIP Program and promotions: calculate each user's level in the VIP Program based on betting volume, credit weekly cashback, and personalize relevant promotional offers.
• Marketing communications (with consent): send emails and notifications about promotions, newly covered sports, casino games, or VIP Program benefits — only when the user has given explicit consent.
• Platform enhancement: analyze usage patterns in an aggregated, anonymous form to identify opportunities to improve the mobile experience, the betting interface, and overall site performance.
• Compliance with legal obligations: respond to requests from competent authorities when required by law, comply with determinations from the Banco Central do Brasil related to financial transactions, and maintain records in accordance with industry regulations.

The LGPD requires that all personal data processing have a legal basis to justify it. 999mm processes user data based on the following legal grounds set out in Article 7 of Law No. 13.709/2018:

• Contract performance: processing is necessary to create your account, handle bets, execute financial transactions, and deliver the other services you agreed to when registering with 999mm.
• Compliance with a legal or regulatory obligation: certain processing activities are required by law, such as CPF verification, retention of financial transaction records, and compliance with anti-money laundering regulations.
• Legitimate interest: for platform security purposes, fraud detection, service improvement based on aggregated data, and protection of betting integrity, provided that 999mm's interests do not override users' rights and freedoms.
• Consent: for marketing communications, non-essential cookies, and other optional purposes, 999mm requests explicit consent and allows you to withdraw it at any time without affecting your access to core services.

Where processing is based on consent, you may withdraw it at any time through your account settings. Withdrawal does not affect the lawfulness of any processing carried out prior to that withdrawal.

999mm does not sell users' personal data or share it with third parties for those companies' own commercial purposes. Data sharing occurs only in the specific, necessary situations described below:

• Payment processors: when making a deposit via Pix, boleto, credit or debit card, PicPay, Mercado Pago, or TED transfer, the data required to process the transaction is shared with the corresponding payment provider. These providers are contractually bound to use the data solely for that purpose.
• Identity verification services: to confirm user identity and meet regulatory obligations, we may share CPF and document data with specialized identity verification service providers, who operate under strict confidentiality obligations.
• Casino content providers: to operate the Live Casino and digital games, technical session data (not personally identifiable information beyond your account ID) is shared with providers such as Evolution Gaming, Pragmatic Play, and similar partners to record game results and betting history.
• Legal and regulatory authorities: 999mm complies with data requests from competent Brazilian authorities when there is a legal obligation, court order, or formal substantiated request. In such cases, we share only the minimum data necessary to fulfill the requirement.
• IT Infrastructure: hosting, database, and network security services that support the platform's operations may have technical access to stored data, always under contracts with strict data protection and confidentiality clauses.

In all data-sharing situations, 999mm contractually requires all third parties involved to maintain security standards consistent with our own and to use the data solely for the authorized purposes.

999mm uses cookies and similar technologies to ensure the platform works correctly, improve user experience, and — with your consent — personalize communications and analyze site usage. The types of cookies we use are:

• Essential cookies: required for the basic operation of the site, such as keeping your session active after login and remembering language preferences. They cannot be disabled without affecting your ability to use the platform.
• Performance cookies: collect anonymous, aggregated data on how users navigate the site, which pages are visited most, and where usability issues occur. Used to improve the overall platform experience, especially on mobile.
• Functional cookies: remember your preferences — such as displaying odds in a specific format or your favorite sport categories — to personalize your experience without requiring you to reconfigure settings on every visit.
• Marketing cookies (with consent only): used to understand which promotions are most relevant to you and to prevent you from seeing the same communications repeatedly. They are activated only with your explicit consent.

You can manage non-essential cookie settings through the consent banner displayed on your first visit or via your browser settings. Disabling essential cookies may affect platform functionality.

999mm does not use cookies to collect sensitive personal data or to track your activity outside the 999mm.best platform without your consent.

999mm retains your personal data only for as long as necessary for the purposes for which it was collected, in compliance with the minimum retention periods required by law. The criteria we use to define retention periods are:

• Active account data: retained for as long as you have an active account with 999mm, to enable access to services and maintain your full betting and transaction history.
• Financial and transaction data: retained for a minimum of 5 years after the last transaction, in accordance with Brazilian regulatory requirements related to anti-money laundering and financial transaction controls.
• Identity verification data (CPF, documents): retained for a minimum of 5 years after account closure, as required by regulation.
• Betting history: retained for a minimum of 3 years for dispute resolution and audit purposes, and available for the user to review throughout that entire period.
• Customer support data: retained for 2 years after the last contact, for reference in cases involving follow-up on recurring issues.
• Non-essential cookie data: deleted or anonymized according to the specific settings for each cookie type, generally within 12 months.

After account closure, data that exceeds the minimum legal retention periods is deleted or anonymized in a way that makes it impossible to identify the user.

999mm implements technical and organizational measures to protect your data against unauthorized access, loss, alteration, or improper disclosure. The main security measures include:

• Encryption in transit: all data is transmitted over HTTPS connections with 256-bit SSL/TLS certificates. This applies to login credentials, registration information, financial transactions, and all other communications between your device and 999mm's servers.
• Encryption at rest: sensitive data stored on 999mm's servers, such as passwords and identity documents, is encrypted at rest using robust encryption standards.
• Access controls: only 999mm team members who genuinely need access to specific data to carry out their duties are authorized to do so. Access is controlled through strong authentication, and access logs are maintained for audit purposes.
• Security monitoring: 999mm's systems are continuously monitored to detect unauthorized access attempts, cyberattacks, and anomalous activity that could compromise data security.
• Testing and audits: 999mm conducts regular security tests to identify and fix vulnerabilities before they can be exploited.
• Two-factor authentication: available to all users and strongly recommended for additional account protection.

In the event of a security incident that may affect users' personal data, 999mm will notify the Autoridade Nacional de Proteção de Dados (ANPD) and the affected users within the timeframes established by the LGPD, providing clear information about what occurred, which data was affected, and what measures are being taken.

The LGPD grants you, as the owner of the personal data processed by 999mm, the following rights, all of which can be exercised free of charge:

999mm is a platform exclusively for users aged 18 and over. We do not intentionally collect personal data from anyone under 18. The registration process requires a date of birth and CPF, which allows us to verify that the user meets the minimum age requirement.

If we become aware that data belonging to a user under 18 has been collected for any reason, we will immediately delete that information and close the corresponding account. Parents or guardians who believe a minor has created an account on 999mm should contact us immediately at suporte@999mm.best so we can act promptly.

999mm does not direct any marketing communications or promotional content to individuals under 18 years of age.

999mm may update this Privacy Policy periodically to reflect changes in the LGPD or other applicable Brazilian legislation, updates to the services offered, changes in data processing practices, or recommendations from the ANPD. The date of the most recent update is always shown at the top of this page.

For changes that reduce your rights or introduce new types of processing that require consent, 999mm will notify users by email at least 7 days before the changes take effect. For minor updates — such as text corrections or clarifications with no practical impact — changes may be made without formal prior notice, with the updated date reflected at the top of the document.

Continued use of the platform after the effective date of any changes constitutes acceptance of the updated version of this Policy. If you do not agree with the changes, you may close your account before the effective date without any penalty.

999mm has appointed a Data Protection Officer (DPO) as required by the LGPD to oversee data processing practices and serve as a communication channel between the company, users, and the National Data Protection Authority (ANPD).

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights as a data subject, please contact us: