Privacy Policy 2kbr — Your Data Protected by the LGPD

A 2kbr is the controller of the personal data collected and processed under this Privacy Policy. For all purposes of the General Data Protection Law (LGPD — Law No. 13,709/2018), the 2kbr is responsible for all decisions regarding the processing of users' personal data on the platform.

The Data Protection Officer (DPO) of 2kbr can be reached by email contato@2kbr.net for any request related to the processing of personal data, the exercise of rights under the LGPD, or questions about this Policy.

A 2kbr collects only the data necessary to provide its services, meet legal obligations, and continuously improve the platform. The categories of data collected are:

Identification Data:

• Full legal name as it appears on an official document.
• CPF (Cadastro de Pessoas Físicas) — Brazilian Federal Revenue.
• Date of birth.
• Identity document (RG number, driver's license, or passport) — collected during the identity verification (KYC) process.

Contact Details:

• Email address.
• Mobile number with Brazilian area code (DDD).
• Full residential address (street, number, unit, neighborhood, city, state, and ZIP code).

Financial Data:

• Pix key registered for withdrawals (CPF, email, phone number, or random key).
• Banking details for TED transfers (bank, branch, checking or savings account) — no banking passwords are stored.
• History of deposits and withdrawals made on the platform.
• Credit and debit card data is processed through a PCI-DSS certified payment gateway — the 2kbr does not store the full card number.

Platform Usage Data:

• History of sports bets placed (events, markets, amounts, and outcomes).
• Session history for Live Casino, slots, and crash games.
• Access logs (IP address, login date and time, device used, operating system, and browser).
• Browsing preferences and account settings defined by the user.
• Interactions with customer support (chat and email history).

Automatically collected data:

• Session and operational cookies required to run the platform.
• Performance and error data for technical diagnostics.
• Approximate geolocation data derived from IP address — precise GPS coordinates are not collected.

The data collected by 2kbr are used exclusively for the purposes described below. Each purpose is tied to a specific legal basis, as detailed in Section 4.

• Account creation and management: Account registration, authentication, identity verification (KYC), and user profile management on the platform.
• Service delivery: Processing and settlement of Sports Betting on Brasileirão, Copa do Brasil, MMA and UFC, basketball via NBB, and other sports; operation of live casino games, slots, and crash games.
• Payment processing: Processing of deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfer; processing of withdrawals to the account holder; fraud detection on financial transactions.
• Compliance with legal obligations: Age and identity verification (regulatory requirement); anti-money laundering compliance (Law No. 9,613/1998); responding to requests from competent authorities.
• User support: Live chat and email support; complaint and dispute resolution; account-related communications.
• Platform security: Detection and prevention of fraud, bonus abuse, and platform misuse; monitoring of suspicious activity.
• Marketing communications: Sending promotions, offers, and news from 2kbr by email or phone — only with the user's consent, which may be withdrawn at any time.
• Platform improvement: Analysis of usage behavior to improve features, speed, and user experience — using anonymized or pseudonymized data whenever possible.

A 2kbr does not use your personal data for any purpose beyond those listed above without prior notice and, where applicable, obtaining new consent.

As required by the LGPD, all personal data processing carried out by 2kbr is grounded in one of the legal bases set out in article 7 of Law No. 13,709/2018:

• Contract performance (art. 7, V): Primary legal basis for processing data required to deliver our services — account creation, bet processing, and payments. Without this data, the service agreement cannot be fulfilled.
• Compliance with a legal obligation (Art. 7, II): Legal basis for processing data required by Brazilian law — identity verification and KYC under regulatory standards, reporting to authorities, anti-money laundering compliance.
• Legitimate interest (Art. 7, IX): Legal basis for processing data related to platform security, fraud detection, technical improvement of services, and protection of 2kbr and other users — provided that such interest does not override the rights and freedoms of the data subject.
• Consent (Art. 7, I): The basis for sending marketing communications and using non-essential cookies. Consent may be withdrawn at any time without affecting any other services.

A 2kbr does not sell personal data. User data is shared only with specific categories of third parties, under the conditions described below:

• Payment providers: Financial institutions and payment gateways required to process deposits and withdrawals via Pix, boleto bancário, credit/debit card, Mercado Pago, and PicPay. Only the minimum data necessary for the transaction is shared.
• Game providers: Companies that supply live casino, slots, and crash games operating within the platform 2kbr. These providers receive anonymized session identifiers required for the technical operation of the games.
• Identity verification services (KYC): Specialized providers for document verification and identity confirmation, used during the registration process and periodic reviews.
• Technology infrastructure: Cloud hosting providers, CDN services, and technical analytics tools that support platform operations. These partners act as data processors under a contractual agreement that requires them to comply with the LGPD.
• Authorities and regulatory bodies: A 2kbr responds to lawful requests from Brazilian judicial, law enforcement, and regulatory authorities when legally required, sharing only the data specifically requested.

All third parties with access to the personal data of users of 2kbr are subject to data processing agreements that require them to handle information solely for the contracted purposes and in compliance with the LGPD.

A 2kbr retains personal data only for as long as necessary to fulfill the purposes for which it was collected or to meet legal requirements. The retention criteria are:

• Active account data: Retained for the entire period the account remains active, plus any additional time needed to resolve pending disputes or audits.
• Financial and transaction data: Retained for a minimum of 5 years after account closure, as required by Brazilian financial and tax legislation (including anti-money laundering obligations).
• Access logs: Retained for a minimum of 6 months in accordance with the Brazilian Internet Act (Law No. 12,965/2014).
• Betting and gaming history: Retained for a minimum of 5 years for audit, dispute resolution, and regulatory compliance purposes.
• Support communications: Retained for 2 years after the request is closed.
• Marketing data (with consent): Deleted within 30 days of consent withdrawal for communications, except where they overlap with data required for other legitimate purposes.

Once the applicable retention period expires, data is securely deleted or anonymized so that the data subject can no longer be identified. User requests for data deletion are fulfilled within the timeframes stated above — any data that must be retained due to a legal obligation will be explicitly communicated to the requester.

A 2kbr implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. The key measures in place include:

• 256-bit SSL/TLS Encryption across all communications between the user's browser and the servers of 2kbr.
• Encryption at rest for sensitive data stored in the database — including CPF, banking details, and identity documents.
• Access control based on the principle of least privilege — each internal team accesses only the data required for their specific functions.
• Multi-factor authentication for administrative access to internal systems.
• Continuous monitoring of unauthorized access attempts and suspicious activity across our systems.
• Encrypted backups with periodic recovery testing.
• Regular training of teams on information security best practices and data protection.
• Card processing via PCI-DSS certified gateway — the 2kbr does not store full credit or debit card details.

In the event of a security incident that may affect data subjects' rights, the 2kbr will notify the Autoridade Nacional de Proteção de Dados (ANPD) and affected users within the timeframes established by the LGPD.

A 2kbr uses cookies and similar technologies to ensure the platform functions correctly and to enhance the user experience. The types of cookies used are:

• Essential cookies: Required for core platform functionality — session authentication, bet slip, and language preferences. These cannot be disabled without affecting your use of the platform.
• Performance cookies: They collect anonymized information about how users interact with the platform (pages visited, time on page, errors encountered) for technical improvement purposes.
• Functionality cookies: Store user preferences (such as decimal or fractional odds format, favorite sports) to personalize the experience.
• Marketing cookies: Used only with explicit consent for communication personalization and campaign analysis. Can be disabled with no impact on platform functionality.

You can manage your cookie preferences at any time through your browser settings. Most browsers allow you to block or delete specific cookies. Please note that disabling essential cookies may prevent the platform from functioning properly.

A 2kbr does not use third-party cookies for cross-site tracking without explicit consent. Tracking pixels and similar technologies used for marketing purposes are subject to the same consent controls described above.

The LGPD grants you, as a personal data subject, a set of rights that 2kbr is committed to respecting and facilitating. See each right and how to exercise it:

• Confirmation and access (art. 18, I and II): You may request confirmation that 2kbr processes your data and to obtain a copy of the information we hold about you.
• Correction (art. 18, III): You may request the correction of incomplete, inaccurate, or outdated data. Basic account information can be updated directly in your account settings.
• Anonymization, blocking, or deletion (Art. 18, IV): You may request the anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in violation of the LGPD.
• Portability (Art. 18, V): You may request the portability of your data to another service or product provider, upon express request, in a structured and commonly used format.
• Deletion upon consent withdrawal (art. 18, VI): Data processed on the basis of your consent may be deleted after withdrawal, except where retention is required by law.
• Right to information about sharing (Art. 18, VII): You have the right to know which public or private entities your data is shared with.
• Withdrawal of consent (Art. 18, IX): Consent may be withdrawn at any time, particularly for marketing communications, at no cost and without any penalty.
• Right to object (art. 18, §2): You may object to processing carried out on the basis of legitimate interest when you have grounds to do so, in which case it is up to 2kbr evaluate the request.

To exercise any of these rights, submit a request to contato@2kbr.net with full identification (full name and CPF). The 2kbr will respond within 15 business days of receipt. Cases requiring more in-depth review may have an extended timeframe, with prior notice given to the requester.

The platform 2kbr is intended exclusively for individuals aged 18 and over. The 2kbr does not knowingly collect personal data from users under 18 and does not permit minors to use its services.

By registering, the user confirms they are at least 18 years old. The identity verification (KYC) process includes date-of-birth confirmation against an official document. Accounts identified as belonging to minors are closed immediately and all associated data is deleted, except for the minimum necessary to record the reason for closure.

If you believe a user under 18 has created an account on 2kbr, please contact us at contato@2kbr.net so we can investigate and take the necessary action.

Some technology infrastructure providers used by 2kbr (such as cloud hosting and CDN services) may be located outside Brazil. When this occurs, the transfer of personal data abroad is carried out only under the conditions set out by the LGPD:

• For countries with an adequate level of data protection, as determined by the ANPD.
• Based on specific contractual clauses that guarantee a level of protection equivalent to that of the LGPD.
• Based on global corporate standards approved by the ANPD.

A 2kbr ensures that, regardless of where data is physically stored, processing complies with the data protection standards required by Brazilian law. The DPO of 2kbr can provide additional information about specific international transfers upon request.

A 2kbr may update this Privacy Policy periodically to reflect changes in Brazilian legislation, data processing practices, or platform features.

Material changes will be communicated by email to the address registered by the user at least 7 days before the new terms take effect. Minor clarifying changes may be implemented without prior notice.

The date of the last update is always shown at the top of this page. We recommend reviewing this Policy periodically to stay informed. Continued use of the platform after changes take effect constitutes acceptance of the new terms.

For any questions, requests, or complaints regarding the processing of personal data by 2kbr, please contact our Data Protection Officer (DPO):

• Email: contato@2kbr.net — Response within 15 business days for LGPD-related requests.
• Live chat: Available 24 hours a day, 7 days a week, directly on the platform after login — for general privacy questions with immediate responses.

Formal requests to exercise LGPD rights must be submitted by email with full identification (full name, CPF, and a detailed description of the request). The 2kbr may request proof of identity before fulfilling a request, to ensure we are serving the legitimate data subject.