FF77 Casino Privacy Policy – Your Data

Ff77 is the Sports Betting and online casino platform operated for the Brazilian market, accessible at ff77.casino. For the purposes of this Privacy Policy, ff77 acts as the controller of personal data collected from users registered in Brazil, and is responsible for decisions regarding the purpose and means of processing that data.

FF77's Data Protection Officer (DPO) can be reached at suporte@ff77.casino with the subject line "Data Privacy – LGPD". All requests relating to data subject rights are handled through this channel as a priority.

FF77 collects personal data at various points during your interaction with the platform. Below, we detail each data category, the purpose of collection, and the applicable legal basis:

Registration data

• Full name, CPF, date of birth, email address, and mobile number — required to create and identify your account, verify eligibility (18 or older, resident in Brazil), and ensure each CPF corresponds to a single account;
• Residential address — requested for identity verification on withdrawals above R$ 2,000.00, in accordance with anti-money laundering requirements.

Identity verification data (KYC)

• A photo ID (national ID card or driver's license) and proof of address — requested to release withdrawals above certain amounts or when the system detects a need for additional identity confirmation. These documents are stored securely and reviewed exclusively for verification purposes;
• Selfie or verification photo — may be requested in specific cases to confirm that the document holder is the same user operating the account.

Financial data

• Pix key — collected for withdrawal processing. The key is linked to the holder's CPF and is never shared with third parties or used for any purpose beyond processing the withdrawal;
• Credit or debit card details — collected solely to process the deposit and immediately tokenized. The full card number is never stored on FF77 servers;
• Transaction history — a record of all deposits and withdrawals made on the account, retained for internal audit purposes, dispute resolution, and regulatory compliance.

Platform usage data

• Betting history — events wagered on, amounts, markets selected, and outcomes. Used to operate the VIP Program, resolve disputes, and detect anomalous behavior;
• Access data — IP address, device type, operating system, browser, and access times. Used for account security, detection of unauthorized access, and platform performance analysis;
• Platform behavior data — pages visited, features used, and session duration. Used to improve the user experience and personalize relevant content within the platform.

Communication data

• Support conversation history — messages exchanged via chat or email, retained for quality control, team training, and future dispute resolution;
• Communication preferences — whether you have opted in or out of receiving promotional communications from FF77.

Data collected by ff77 is used exclusively for the purposes listed below. No data is used for any purpose other than what was stated at the time of collection, without further notice to the data subject:

• Account operation: create, manage, and maintain your active account on the platform, including access authentication and session management;
• Transaction processing: process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfer, as well as process withdrawals via Pix to the account holder's bank account;
• Eligibility verification: confirm that the user is 18 or older, resides in Brazil, and is eligible to use the platform in accordance with the Terms and Conditions;
• Fraud and money laundering prevention: monitor transactions and platform behavior to identify suspicious patterns and meet regulatory obligations for financial crime prevention;
• VIP Program and promotions: calculate VIP points, apply weekly cashback, and direct relevant promotions based on betting history;
• User support: handle requests, resolve issues, and improve service quality based on interaction history;
• Platform security: detect and prevent unauthorized access, attacks, and intrusion attempts;
• Legal compliance: comply with obligations imposed by applicable Brazilian laws and regulations, including the LGPD and anti-money laundering rules;
• Service improvement: analyze aggregated, anonymized platform usage data to identify opportunities to improve the user experience.

Ff77 does not use users' personal data for targeted advertising outside the platform or to build behavioral profiles for sale to third parties.

FF77 does not sell or share users' personal data with third parties for commercial purposes. Data sharing occurs only in the following specific situations and with the necessary safeguards in place:

• Payment processors: partners responsible for processing transactions via Pix, credit/debit card, PicPay, and Mercado Pago receive only the data strictly necessary to execute each transaction. These partners operate under contracts that require data protection equivalent to this policy and full LGPD compliance;
• Identity verification providers: for KYC verification purposes, documents may be processed by partners specialized in identity verification, always under confidentiality agreements and with access strictly limited to the verification process;
• Regulatory and judicial authorities: ff77 may share data with competent authorities when required by law, court order, or applicable regulation — for example, the Financial Activities Control Council (COAF) or the National Data Protection Authority (ANPD);
• Technology infrastructure providers: partners responsible for hosting, network security, and system monitoring have restricted technical access only to the data necessary to keep the platform running, with no access to users' financial or personal content.

FF77 applies technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. The main safeguards currently in place are:

• 256-bit SSL encryption: all communication between your device — whether a computer, mobile phone, or tablet — and ff77's servers is encrypted in transit. This prevents any data intercepted on the network from being readable by third parties;
• Financial data tokenization: credit/debit card data is immediately tokenized at the point of entry. The generated token represents the transaction without exposing actual card details. The full card number is never stored in FF77's systems;
• Role-based access control: only FF77 employees with a proven operational need have access to specific user data. Access is audited and every action is recorded in a log;
• Two-step authentication for sensitive changes: any changes to banking details — such as the Pix key registered for withdrawals — require confirmation via a code sent to the account holder's email and mobile number. This process prevents fraudulent redirection of withdrawals;
• Continuous security monitoring: automated systems monitor access and transactions in real time to identify suspicious patterns. Anomalies trigger immediate alerts to the security team;
• Periodic penetration testing: FF77's infrastructure is regularly tested by security professionals to identify and remediate vulnerabilities before they can be exploited;
• Secure KYC document storage: documents submitted for identity verification — national ID (RG), driver's license (CNH), proof of address — are stored in an isolated environment, accessible only to the compliance team, and disposed of after the mandatory retention period.

Despite all these measures, no system is 100% impenetrable. In the event of a security incident that may affect users' personal data, ff77 will follow the notification procedures set out in the LGPD, informing the affected data subjects and the ANPD within the legally required timeframes.

Ff77 retains personal data only for as long as necessary for the purposes that justified its collection, in compliance with the minimum retention periods required by law. The main retention periods applied are as follows:

• Active account data: retained for as long as the account remains active. After the account is closed by the user, data is kept for at least 5 years to meet tax and regulatory obligations;
• Financial transaction history: retained for 10 years after each transaction, as required by anti-money laundering legislation (Law No. 9.613/1998) and COAF regulations;
• KYC documents (government-issued ID, driver's license, proof of address): retained for the period required by applicable regulatory standards, generally 5 years from the date of verification or account closure, whichever is later;
• Betting history: retained for 5 years for dispute resolution, auditing, and compliance purposes;
• Access logs and security data: retained for 2 years for security and incident investigation purposes;
• Support history: retained for 3 years for quality control and dispute resolution purposes.

Once retention periods expire, data is securely deleted or anonymized so that the individual can no longer be identified.

The LGPD grants you, as the data subject whose personal data is processed by FF77, the following rights, which may be exercised at any time through the contact channel indicated in this policy:

To exercise any of these rights, contact us at suporte@ff77.casino with the subject line "Privacidade de Dados – LGPD" and specify which right you wish to exercise. No justification is required, and you do not need a lawyer. FF77 may ask you to confirm your identity before processing the request, to ensure we are responding to the correct data subject.

FF77 uses cookies and similar technologies to ensure the platform runs correctly, improve the user experience, and collect aggregated analytics data. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — keeping your session active after login, remembering language preferences, and ensuring the bet slip works correctly. These cannot be disabled without impairing your use of the platform;
• Analytics cookies: collect anonymous, aggregated data on how users interact with the platform — which pages are visited most, how long users spend in each section, and which devices they use. This data is used solely to improve the platform and is never linked to individual identities;
• Preference cookies: remember settings you've configured — such as display theme, default language, and notification preferences — so you don't have to reconfigure them every time you log in;
• Security cookies: used by the fraud detection system to identify suspicious access behavior, such as login attempts from multiple IPs or patterns associated with bots.

You can manage your non-essential cookie preferences through your account settings panel or your browser settings. Disabling essential cookies may prevent some platform features from working correctly.

Ff77 may send communications to your registered email address and mobile number in the following situations:

• Mandatory transactional communications: deposit confirmations, withdrawal confirmations, security alerts (login attempt from a new device, password change), account verification notifications, and important updates to the Terms or this Privacy Policy. These communications cannot be disabled as they are required to operate your account securely;
• Promotional communications: news about promotions, available bonuses, VIP Program updates, and information on new games and sports events covered by ff77. These communications are optional — you can opt out during registration or at any time through your account preferences panel.

To unsubscribe from promotional communications, go to the notification settings in your account dashboard or click the unsubscribe link in any promotional email you receive. Requests are processed within 48 hours and do not affect mandatory transactional communications.

FF77 will never send communications asking for your password, card details, full Pix key, or any other sensitive information via email, SMS, or WhatsApp. If you receive a message like this claiming to be from FF77, treat it as a phishing attempt — do not click any links and report it to support immediately.

FF77 services are intended exclusively for users aged 18 and over. The platform does not intentionally collect personal data from minors. During registration, users declare they have reached the legal age, and FF77 performs additional age verification as part of the identity verification (KYC) process.

If FF77 identifies that data from a user under 18 has been inadvertently collected, the account will be immediately closed and all associated data will be deleted, with any balance returned to the original deposit method. Parents or guardians who discover that a minor has created an account on FF77 should contact support immediately so the case can be handled as a priority.

FF77 encourages parents and guardians to use the parental control tools available on devices and browsers to prevent minors from accessing betting platforms.

Ff77 may update this Privacy Policy periodically to reflect changes in data processing practices, legal obligations, or platform features. Any significant update will be communicated at least 7 days in advance by email to registered users and via a prominent notice on the account dashboard.

The date of the most recent update is shown at the top of this page. Continued use of the platform after an updated version takes effect constitutes acceptance of the changes. If you do not agree with a particular change, you may close your account as described in the Terms and Conditions — any available balance will be returned via Pix.

A version history of previous iterations of this policy can be requested through support for reference.

For any questions, rights requests, or complaints regarding how FF77 handles your data, you can reach us through the following channels:

• Live chat: available 24 hours a day, 7 days a week, directly on the platform. Average response time under 3 minutes. Use this channel for general privacy inquiries;
• Email for privacy matters: suporte@ff77.casino — use the subject line "Data Privacy – LGPD" so your message is routed directly to the Data Protection Officer. Response time: up to 5 business days;
• To exercise your LGPD rights: use the same email with the subject line "Exercise of Rights – LGPD" and clearly state which right you wish to exercise. The response deadline for formal rights requests is up to 15 business days, as required by law.

All privacy-related support is handled in Brazilian Portuguese, with no legal formality required. FF77 is committed to responding clearly and treating every request with the seriousness it deserves.

If you are not satisfied with ff77's response, you have the right to file a complaint directly with the National Data Protection Authority (ANPD) through that body's official channels.