Privacy Policy of luck66: your data protected

The luck66 respects the privacy of all its users and is committed to protecting the personal data you entrust to us when using the platform. This Privacy Policy clearly explains what data we collect, why we collect it, how we use it, who we may share it with, and what rights you have as the owner of that data.

All personal data processing carried out by luck66 strictly complies with the General Personal Data Protection Law (LGPD – Law No. 13.709/2018), the Consumer Protection Code (Law No. 8.078/1990), and all other applicable Brazilian regulations governing the online betting and gaming sector.

If you have any questions about how your data is handled or would like to exercise any of your rights as a data subject, please contact us at privacidade@luck66.best or via the support chat available 24 hours a day in Portuguese. Our team responds within 15 business days for requests related to personal data.

The controller responsible for processing personal data collected on the platform luck66 is the operating company of the luck66.best platform. For all matters related to privacy and data protection, the official contact channel is privacidade@luck66.best.

The luck66 has appointed a Data Protection Officer (DPO) in accordance with Article 41 of the LGPD, responsible for serving as the point of contact between the platform, data subjects, and the National Data Protection Authority (ANPD). The DPO can be reached directly by email at dpo@luck66.best.

The luck66 collects different categories of personal data depending on how you interact with the platform. The main categories and the contexts in which they are collected are listed below:

The luck66 does not intentionally collect data falling under the sensitive categories defined by Article 11 of the LGPD (such as racial origin, religious beliefs, health data, or sexual orientation). Should any sensitive data be voluntarily provided by a user through support channels, it will not be used for data processing purposes and will be discarded.

The personal data collected by luck66 are used exclusively for the purposes listed below. Should the platform need to process your data for a purpose other than those described here, you will be notified in advance and, where required, your consent will be requested before any new processing takes place.

• Account operation: creation, maintenance, and management of your player account, including access authentication, password recovery, and profile settings;
• Transaction processing: deposits via Pix, boleto bancário, credit/debit card, Mercado Pago, PicPay, and TED bank transfers; withdrawal processing to your bank account or Pix key;
• Identity verification (KYC): confirmation of your identity and eligibility to use the platform, as required by anti-money laundering and counter-terrorism financing legislation;
• Fraud prevention: identifying and blocking fraudulent behavior, multi-account use, bonus abuse, and other activities prohibited under the Terms and Conditions;
• Compliance with legal obligations: compliance with the requirements of Brazilian legislation applicable to the betting sector, the LGPD, and any court orders or determinations from competent authorities;
• Service improvements: analysis of platform usage patterns to identify areas for improvement, fix bugs, optimize performance, and develop new features;
• Experience personalization: recommending relevant games, personalizing promotions, and adapting the interface based on your usage history;
• Service Communications: sending notices about transactions, account updates, and changes to this Policy and the Terms and Conditions;
• Marketing and promotions: sending relevant offers, bonuses, and promotions via email, push notification, or SMS – only with your consent, which may be withdrawn at any time.

The luck66 processes personal data based on the legal grounds established by the LGPD (Article 7). For each processing purpose, we apply the most appropriate legal basis:

• Performance of a contract (art. 7, V): processing necessary to operate your account, handle deposits and withdrawals, and provide the Sports Betting and casino services you signed up for on the platform;
• Compliance with a legal obligation (Art. 7, II): identity verification (KYC), anti-money laundering compliance, fulfillment of court orders, and compliance with Brazil's online betting regulations;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, service improvement, and personalization of the user experience;
• Consent (Art. 7, I): sending marketing communications and using non-essential cookies. Consent can be withdrawn at any time without affecting your access to the services of the luck66.

The luck66 does not sell, rent, or trade your personal data with third parties for any purpose. Data is shared only in the strictly necessary situations listed below, and always with the minimum amount of information required for each purpose:

• Payment processors: information required to process deposits and withdrawals via Pix, boleto bancário, credit/debit card, Mercado Pago, and PicPay. Financial data is transmitted in encrypted form, and payment partners act as processors under luck66's instructions;
• Game providers: session data (with no direct personal identification) required for the technical operation of games provided by partners such as Evolution Gaming, Pragmatic Play, and others. This data is used solely to deliver the gaming service;
• Identity verification providers: documents and data provided during the KYC process are shared with certified identity verification providers to confirm your eligibility and prevent fraud;
• Competent authorities: data may be shared with Brazilian authorities (such as the Federal Revenue Service, COAF, and law enforcement or judicial bodies) when required by law, court order, or investigation of unlawful activity;
• Technical service providers: infrastructure, hosting, data analytics, and security providers that act as processors under contract with luck66 and are bound by equivalent confidentiality and data protection obligations.

All third parties that receive personal data from luck66 are contractually required to handle this information in accordance with the LGPD and the security standards set by the platform. The luck66 is not responsible for data processing carried out by third parties outside the scope of the instructions set out in the applicable contract.

The luck66 retains personal data for as long as necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations. The criteria used to determine retention periods are:

• Active account data: retained for the entire period during which the account is active on the platform;
• Financial transaction data: retained for at least 5 years after the transaction, as required by Brazilian anti-money laundering legislation (Law No. 9.613/1998);
• Identity Verification Data (KYC): retained for at least 5 years after account closure, in accordance with regulatory requirements for the sector;
• Support data: retained for 2 years after a support case is closed, for reference in future disputes;
• Usage data and logs: retained for 12 months for security and service improvement purposes.

Once the applicable retention period expires, data is securely deleted or anonymized, unless continued retention is required to fulfill a legal obligation, exercise rights in judicial, administrative, or arbitration proceedings, or when a competent authority has issued an order preventing deletion.

The luck66 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. The key security measures currently in place include:

• TLS encryption on all data transmissions between you and the platform;
• Password storage using irreversible hash algorithms (bcrypt);
• Credit card data tokenization – no full card number is stored on luck66's servers;
• Role-based access control (RBAC) for internal systems, ensuring that only authorized staff can access personal data as needed for their role;
• Continuous monitoring of access and suspicious activity across our systems;
• Regular security testing, including penetration tests and vulnerability assessments;
• Incident response plan with notification to the ANPD and affected individuals in the event of a data breach, as required by the LGPD.

Despite all security efforts, no system is completely immune to risk. In the event of a security incident that poses a significant risk to your rights and freedoms, the luck66 will notify the ANPD and inform affected data subjects within the timeframes established by the LGPD.

The luck66 uses cookies and similar technologies (such as localStorage and tracking pixels) to ensure the platform works properly, improve your experience, and understand how our services are used. The cookies we use fall into the following categories:

• Essential cookies: required for the platform's basic operation – maintaining your login session, account security, and basic interface preferences. These cannot be disabled without affecting access to the services;
• Performance cookies: collect anonymized information about how users navigate the platform (most visited pages, session duration, errors encountered) for technical improvement purposes;
• Functionality cookies: store your language preferences, favorite game type, and platform settings to personalize your experience;
• Marketing cookies: used only with your express consent to personalize promotions and communications. They can be disabled in your cookie settings without losing access to the platform.

You can manage your cookie preferences through the banner shown on your first visit or via the cookie settings available in the platform's footer. You can also configure your browser to block or delete cookies automatically, though this may affect certain features of the luck66.

The LGPD grants you, as the data subject whose personal data is processed by the luck66, a set of rights you can exercise at any time. All your rights and how to use them are listed below:

The services of luck66 are intended exclusively for users aged 18 and over. The platform does not intentionally collect personal data from minors and implements technical and procedural measures to prevent minors from registering or accessing the platform, including date-of-birth verification at registration and a KYC process that confirms the user's age.

If the luck66 identifies that data from a user under 18 has been collected, that data will be immediately deleted and the account will be closed. Parents or legal guardians who believe a minor has used the platform should contact us immediately at privacidade@luck66.best.

Some of the technology vendors and service providers used by luck66 — such as cloud infrastructure providers, live game suppliers, and technical analytics tools — may have servers located outside Brazil. In such cases, any international transfer of personal data is carried out in accordance with Article 33 of the LGPD, with one of the following safeguards in place:

• Transfer to countries or international organizations that provide a level of personal data protection equivalent to that required by the LGPD, as recognized by the ANPD;
• Safeguards provided by the international operator through specific data protection contractual clauses approved by the ANPD;
• Binding corporate rules that guarantee equivalent protection standards.

The luck66 ensures that no international transfer takes place without appropriate safeguards, and that any transferred data is handled with the same level of protection required under Brazilian law.

The luck66 may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, or data processing practices. The date of the last update is always shown at the top of this page.

Significant changes — those that materially affect how your data is processed or that reduce your rights — will be communicated by email at least 10 days before taking effect. Minor changes that are purely clarifying or formatting in nature will be implemented without prior notice, but the latest version will always be available on this page.

Continued use of the platform after the effective date of any changes constitutes acceptance of the updated version of this Policy. If you do not agree with the new terms, you may close your account before the changes take effect.

For any questions, requests, or complaints related to the processing of your personal data by luck66, use the channels below:

• General privacy email: privacidade@luck66.best
• DPO E-mail: dpo@luck66.best
• Customer support: live chat available 24/7 in Portuguese on the luck66 website and app
• General support email: suporte@luck66.best

Requests related to data subject rights (access, correction, deletion, portability, etc.) are responded to within 15 business days. For more complex cases requiring additional verification, we may extend this period by a further 15 days, notifying you of the reason for the extension.

If after contacting luck66 you feel your rights as a data subject have not been adequately addressed, you may file a complaint directly with the National Data Protection Authority (ANPD), as provided for in Article 18, sole paragraph, of the LGPD.