22bb Privacy Policy — LGPD Data Protection

1. Introduction

The 22bb understands that privacy is not optional — it's a fundamental right. That's why this Privacy Policy was designed to be straightforward, comprehensive, and easy to understand for anyone using our Sports Betting and online casino platform in Brazil.

This document describes how the 22bb collects, uses, stores, protects, and may share the personal data of Users registered on the 22bb.click website and all associated services — betting on the Brasileirão, UFC, live casino, roulette, slots, crash games, and the VIP Program.

The 22bb operates in compliance with the General Personal Data Protection Law (LGPD — Law 13.709/2018) and follows international best practices for data protection. No personal data is processed arbitrarily: every processing operation has a specific purpose, a defined legal basis, and a set retention period.

This Policy should be read together with the Terms and Conditions and the Responsible Gambling of the 22bb, which form an integral part of the relationship between you and the platform.

2. Data Controller

For the purposes of the LGPD, the controller responsible for processing the personal data collected on the platform 22bb is the operating company behind the 22bb.click website, headquartered in Brazil.

The Data Protection Officer (DPO) of 22bb can be reached through the following channels:

• DPO email: privacidade@22bb.click
• General email: contato@22bb.click
• Live chat: available 24/7 on the 22bb.click platform

The DPO of 22bb is responsible for receiving data subject requests, handling complaints, and ensuring that all data processing operations carried out by the platform comply with the LGPD and other applicable regulations.

3. Data We Collect

The 22bb collects only the data necessary to deliver its services with quality, security, and legal compliance. Below is a full overview of the data categories collected:

The 22bb does not collect sensitive category data (racial origin, political opinion, health information, sexual orientation) beyond what is strictly required to fulfill specific legal obligations.

4. Purpose of Processing

Each piece of data collected by 22bb has a specific and legitimate purpose. We do not use data for purposes incompatible with the reason it was collected. The main purposes are:

• Account creation and management: name, CPF, email, and phone number are required for registration, authentication, and communication with the User.
• Financial transaction processing: bank details (Pix, wire transfer) are used exclusively to process deposits and withdrawals on the platform.
• Identity verification and fraud prevention: identity documents and proof of address are required to comply with Brazilian anti-money laundering regulations (AML/CFT) and to prevent fraudulent use of the platform.
• Service delivery: betting history and gaming sessions are required to resolve disputes, calculate bonuses, and generate activity reports for the User.
• Responsible gambling: usage data is analyzed to identify patterns of at-risk behavior and trigger responsible gambling protocols when necessary.
• Marketing communications: email and mobile number may be used to send promotions and updates from 22bb, provided the User has not opted out of receiving them. You may unsubscribe at any time in your account settings.
• Platform improvement: technical and usage data are analyzed in aggregated and anonymized form to improve the experience of the 22bb.
• Compliance with legal obligations: certain data is retained to meet regulatory, tax, and judicial requirements.

5. Legal Basis for Processing (LGPD)

The LGPD requires that all personal data processing have a defined legal basis. The 22bb bases its data processing operations on the following legal grounds set out in Article 7 of Law 13.709/2018:

• Contract performance (art. 7, V): processing required to fulfill the betting and casino services agreement accepted by the User at registration — includes transaction processing, account management, and betting history.
• Compliance with a legal or regulatory obligation (Art. 7, II): collection and retention of data required by law, such as identity documents for AML/CFT compliance, tax records, and reports to the relevant authorities.
• Legitimate interest (art. 7, IX): technical data analysis for fraud prevention, platform security, and service improvement — always respecting the User's rights and expectations.
• Consent (art. 7, I): sending marketing communications and using non-essential cookies, with the option to withdraw consent at any time.

6. Data Sharing

The 22bb does not sell personal data of Users to third parties, under any circumstances. Data sharing occurs only in the strictly necessary cases listed below:

• Payment providers: bank details are shared with Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago operators solely to process transactions authorized by the User.
• Gaming software providers: username and session history may be shared with Live Casino and game providers for technical game operation purposes.
• Identity verification services: identity documents and CPF may be shared with authorized verification bureaus to confirm User eligibility and comply with AML/CFT regulations.
• Public authorities: data may be disclosed to government, regulatory, or judicial authorities when required by law, court order, or official investigation, without the need for prior User consent in such cases.
• Audits and certifications: aggregated and anonymized data may be shared with independent auditors for regulatory compliance certification.

All third parties that receive data from Users of 22bb are contractually required to handle this information with the same level of protection mandated by the LGPD and this Privacy Policy.

7. Data Retention and Deletion

The 22bb retains Users' personal data only for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law.

• Identification and active account data: retained for as long as the account remains active on the platform.
• Financial transaction data: retained for a minimum of 5 years after the transaction, in accordance with tax and AML/CFT requirements.
• Betting history and gaming sessions: maintained by 2 years after the last activity, for dispute resolution and responsible gambling analysis purposes.
• Support and communications data: retained for 1 year after the ticket is closed.
• Closed account data: after account closure, data is anonymized or deleted within 90 days, unless a legal obligation requires a longer retention period.

Once the applicable retention period expires, data is securely deleted or irreversibly anonymized, with no possibility of re-identification.

8. Data Security

Protecting Users' personal data is a core technical and operational priority of 22bb. The following security measures are in place on the platform:

• SSL 256-bit encryption: all communications between the User's browser or mobile device and the servers of 22bb are encrypted using the TLS 1.3 standard.
• Encryption of data at rest: sensitive data stored on the servers of the 22bb are encrypted at rest using AES-256 algorithms.
• Two-factor authentication (2FA): available to all Users as an additional layer of account protection.
• Continuous monitoring: intrusion detection systems and suspicious activity monitoring operate 24 hours a day on the systems of 22bb.
• Access control: User data is accessible only by employees with a legitimate operational need, with auditable records of all access.
• Regular security testing: the platform of the 22bb undergoes regular penetration testing and security audits carried out by independent teams.

In the event of a security incident that poses a significant risk to Users, the 22bb will notify affected data subjects and the Autoridade Nacional de Proteção de Dados (ANPD) within the timeframes established by the LGPD.

9. Cookies and Tracking Technologies

The 22bb uses cookies and similar technologies to ensure the platform functions correctly, improve the User experience, and, with consent, personalize content and analyze site performance. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — authentication, gaming sessions, and language preferences. They cannot be disabled without affecting your use of the service.
• Analytical cookies: used to understand how Users navigate the platform, in aggregated and anonymized form. They help identify pages with usability issues and improve the overall experience.
• Personalization cookies: store User preferences — such as favorite games and interface settings — to deliver a more personalized experience on 22bb.
• Marketing cookies: used only with explicit consent, to measure campaign effectiveness and display content relevant to the User's profile.

You can manage your cookie preferences at any time through your browser settings or via the privacy preference panel available on the 22bb. Disabling non-essential cookies does not prevent access to the core services.

10. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, a set of rights that 22bb respects and facilitates the exercise of these rights. See each right and how to exercise it:

To exercise any of the rights listed above, please contact the DPO of 22bb via email at privacidade@22bb.click or through the platform's live chat. We process requests within 15 business days from the date of receipt, in accordance with the deadline established by the LGPD.

11. Users Under 18

The services of the 22bb are intended exclusively for users aged 18 and over. The platform does not intentionally collect personal data from minors and takes active measures to prevent underage access and registration:

• CPF and date of birth verification required at registration.
• Identity document verification required before the first withdrawal.
• Automated monitoring to identify potentially underage accounts.

If you are the guardian of a child or adolescent and suspect they have created an account on 22bb, please contact us immediately at privacidade@22bb.click. The account will be closed and all data deleted within 72 hours of confirmation.

Parents and guardians who wish to implement parental controls to block minors' access to betting sites can use the parental control features available on Android, iOS operating systems, and in home router settings.

12. International Data Transfers

Some of the technology and gaming software providers used by the 22bb operate servers outside Brazil. When personal data of Brazilian Users is transferred internationally, 22bb ensures that these transfers comply with article 33 of the LGPD, through:

• Transfers to countries with a level of data protection recognized as adequate by the ANPD.
• Specific contractual clauses that impose on the recipient the same level of protection required by the LGPD.
• Internationally recognized certifications and compliance seals held by the recipient data operators.

The 22bb does not carry out international data transfers beyond what is strictly necessary to operate the services contracted by Users. Detailed information about recipient countries and applicable safeguards can be requested from the DPO at privacidade@22bb.click.

13. Changes to This Policy

The 22bb may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, or data processing practices. Users will be notified of any relevant changes at least 7 days in advance by email and through a prominent notice on the platform.

After the updated version takes effect, continued use of the platform constitutes acceptance of the new terms. If you do not agree with the changes, you may close your account and request deletion of your data as described in section 10.

The date of the last update to this Policy is always shown at the top of the page. Previous version history can be requested from the DPO of the 22bb.

14. Contact & Data Protection Officer (DPO)

To exercise your data subject rights, clarify questions about this Policy, or file a complaint regarding the processing of your personal data by 22bb, please contact our Data Protection Officer (DPO):

• DPO email: privacidade@22bb.click
• General email: contato@22bb.click
• Live chat: available 24/7 at 22bb.click

The 22bb commits to responding to all personal data requests within 15 business days. For more complex requests, this deadline may be extended by an equal period, with prior notice to the User.

If you are not satisfied with the response received, you may file a complaint directly with the National Data Protection Authority (ANPD), the authority responsible for overseeing compliance with the LGPD in Brazil.