19win Privacy Policy — LGPD Data Protection

1. Who We Are & Scope of This Policy

This Privacy Policy applies to the platform 19win, accessible at 19win.click, and governs the processing of personal data of all users registered with or interacting with 19win's services in Brazil. For the purposes of this Policy and the Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018), 19win acts as the data controller of the personal data it collects and processes.

19win is a Sports Betting and online casino platform dedicated to Brazilian users, offering bets on football (Brasileirão Série A, Copa do Brasil, Libertadores, state championships, and international competitions), MMA and UFC, volleyball, basketball via NBB, e-sports, and casino games including slots, crash games, live roulette, blackjack, and baccarat with Portuguese-speaking dealers.

This Policy applies to all data collected through the web platform, email and mobile notifications, support chat, and any other touchpoints between the user and 19win. By creating an account or continuing to use the platform, you confirm that you have read and understood this Policy.

2. What Data We Collect About You

19win collects different categories of personal data depending on the purpose and context of the interaction. Below, we detail what we collect and when:

2.1 Registration Data

When you create your account at 19win, we collect:

• Full name;
• CPF — Individual Taxpayer Registration;
• Date of birth;
• Email address;
• Phone number;
• Full residential address (including ZIP code).

2.2 Identity Verification Data (KYC)

To process withdrawals and meet regulatory anti-money laundering obligations, we collect:

• Copy of an official government-issued photo ID (RG, CNH, or passport);
• Proof of address issued within the last 90 days;
• A verification selfie holding your identity document, as instructed on the dashboard.

2.3 Financial Data

To process deposits and withdrawals, we collect:

• Pix key linked to the account holder's CPF;
• Transaction data (amount, date, payment method used — Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, TED bank transfer via banks such as Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, and others);
• Financial transaction history on the platform.

Important: 19win does not store full credit or debit card numbers. This information is processed directly by our partner payment gateway, which holds its own security certifications.

2.4 Platform Usage Data

While you use 19win, we automatically collect data about how you interact with the platform:

• IP address and approximate geolocation data;
• Device type, operating system, and browser used;
• Pages visited, session duration, and navigation flow;
• Sports betting history and casino game activity (slots, crash games, live tables);
• Game preferences and account settings.

2.5 Communication Data

When you contact 19win support — whether via live chat, email, or any other channel — we collect the content of those conversations for troubleshooting, team training, and service improvement purposes.

3. How We Use Your Data

19win uses your personal data strictly for the purposes described below. There is no undisclosed secondary use — every piece of data collected has a specific, internally documented purpose.

• Account creation and management: registration, authentication, profile settings, and preferences;
• Processing financial transactions: deposits via Pix, bank slip, card, and other methods, as well as withdrawals — including verification that the payment method belongs to the account holder;
• Identity verification (KYC): confirmation that you are over 18 years of age and a resident of Brazil, as required by anti-money laundering regulations;
• Provision of betting and casino services: records of Sports Betting on the Brasileirão, Copa do Brasil, and other competitions; operation of casino games (slots, crash games, live roulette, blackjack, baccarat);
• Account-related communications: security notifications (login attempts, password changes), deposit and withdrawal confirmations, alerts about active promotions and rollover completion;
• User support: resolving questions, technical issues, and complaints via live chat and email;
• Fraud prevention and security: detection of multiple accounts, unauthorized use, result manipulation, and other conduct prohibited by the Terms and Conditions;
• Compliance with legal obligations: retention of financial records in accordance with Brazilian tax legislation and Central Bank regulations applicable to the Pix system;
• Platform improvement: analysis of aggregated and anonymized usage data to identify usability issues and product improvement opportunities.

4. Legal Basis for Data Processing (LGPD)

The LGPD requires that all personal data processing have an appropriate legal basis. 19win aligns each processing category with one of the bases set out in Article 7 of Law No. 13,709/2018:

• Contract performance (art. 7, V): registration, financial, and KYC data — required to open your account, process payments, and provide the sports betting and casino services you signed up for;
• Compliance with a legal obligation (art. 7, II): retention of transaction records and identity verification, as required by Brazilian anti-money laundering legislation and Central Bank regulations;
• Legitimate interest (art. 7, IX): platform usage data for security, fraud detection, and service improvement purposes — always in line with your rights and expectations;
• Consent (art. 7, I): non-essential analytics and marketing cookies, optional promotional communications — in these cases, you may withdraw consent at any time through your account settings or by contacting support.

5. Sharing Data with Third Parties

19win shares personal data with third parties exclusively in the situations described below, always with contractual confidentiality guarantees and, where applicable, LGPD compliance:

5.1 Payment Providers

To process deposits and withdrawals via Pix, boleto bancário, credit or debit card, PicPay, Mercado Pago, and TED transfer, 19win shares only the minimum necessary data with our partner payment gateways. These providers are contractually required to use the data solely for transaction processing.

5.2 Game Providers

To provide slots, crash games, live casino (roulette, blackjack, baccarat), and other game categories, 19win shares an anonymized session identifier with partner providers — such as Pragmatic Play, Evolution Gaming, and Spribe — without transmitting any personally identifiable data beyond what is technically necessary to operate the game.

5.3 Identity Verification (KYC)

The KYC process may involve specialized document verification and biometric validation providers. These partners have restricted access to submitted documents solely for verification purposes and may not use the data for any other purpose.

5.4 Competent Authorities

19win may be required to disclose users' personal data in response to valid legal requests issued by Brazilian judicial or administrative authorities — such as the Ministério Público, Receita Federal, or Banco Central — as required by applicable Brazilian law. In such cases, 19win will comply with the legal obligation and, where permitted by law, notify the affected user.

6. How Long We Retain Your Data

19win retains your personal data for only as long as strictly necessary for the purposes that justified its collection, in compliance with the minimum retention periods required by Brazilian law:

• Financial transaction records: minimum of 5 years, as required by the Receita Federal and anti-money laundering legislation (Law No. 9.613/1998);
• KYC documents (RG, CNH, proof of address): for as long as the account is active and for up to 5 years after closure, in accordance with regulatory requirements;
• Registration and profile data: for as long as the account is active. After account closure, for up to 5 years or until the resolution of any pending disputes;
• Betting and gaming history: for as long as the account is active and for up to 2 years after closure, for internal audit and dispute resolution purposes;
• Support records (chats and emails): for up to 2 years after the ticket is closed, for quality and training purposes.

Once the applicable retention periods expire, data is anonymized or securely deleted from 19win's systems, making it impossible to identify the individual.

7. How We Protect Your Data

The security of your personal data is a structural priority at 19win. We have implemented multiple layers of technical and organizational protection to minimize the risk of unauthorized access, data loss, or breaches:

• SSL/TLS Encryption: all communication between your browser or mobile device and 19win's servers is encrypted with TLS 1.2 or higher, preventing data interception in transit;
• Encrypted storage: sensitive data such as passwords are stored using secure hashing (bcrypt). KYC data is stored in an isolated environment with restricted access controls;
• Internal access control: only 19win staff with a specific operational need are granted access to certain data categories — based on the principle of least privilege;
• Security monitoring: intrusion detection systems and anomaly monitoring operate continuously to identify suspicious activity across platform systems;
• Two-factor authentication (2FA): available and encouraged for all users, significantly reducing the risk of unauthorized account access even if your password is compromised;
• Periodic reviews: the 19win security team conducts regular assessments of security controls and data processing procedures.

In the event of a security incident involving users' personal data that could result in significant risk or harm, 19win will notify the Autoridade Nacional de Proteção de Dados (ANPD) and the affected users within the timeframes established by the LGPD.

8. Cookies and Tracking Technologies

19win uses cookies and similar technologies to keep the platform running, improve the user experience, and analyze site usage. Below, we explain the types of cookies used and how you can manage them:

8.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. Without them, you would not be able to log in, navigate the platform, or place bets. Because they are necessary for the service you have contracted, they are enabled automatically and cannot be disabled:

• Authentication session cookies (keep you logged in during your visit);
• Security cookies (CSRF protection and others);
• Basic preference cookies (language, session settings).

8.2 Analytical Cookies

These cookies help us understand how users interact with the platform — which pages are visited most, where navigation issues occur, and how we can improve the experience. The data collected is aggregated and anonymized, meaning no individual user is identified. They are enabled by default but can be disabled in the cookie settings:

• Navigation flow data within the platform;
• Average session duration and registration completion rate;
• Page load performance across different devices.

8.3 Marketing & Personalization Cookies

These cookies are only activated with your explicit consent. They are used to personalize promotional communications from 19win and to measure campaign effectiveness — never to share data with external advertising networks. You can withdraw this consent at any time through your account settings or via the cookie banner shown on your first visit.

8.4 Cookie Management

In addition to the 19win platform settings, you can manage cookies directly through your browser — Chrome, Safari, Firefox, and others allow you to block or delete cookies in your privacy settings. Disabling essential cookies may affect platform functionality.

9. Your Rights as a Data Subject (LGPD)

The General Data Protection Law grants you, as the data subject whose personal data is processed by 19win, the following rights — all of which can be exercised through live support or by email:

To exercise any of these rights, contact 19win support via live chat — available 24 hours a day — or send an email to suporte@19win.click with the subject line "LGPD Request — [describe the right]". Requests are responded to within 15 business days from receipt, and may be extended by an additional 15 days in more complex cases, with prior notice to the user.

If you feel that 19win has not adequately responded to your request, you have the right to file a complaint with the National Data Protection Authority (ANPD), the federal authority responsible for enforcing the LGPD in Brazil.

10. Protection of Minors

The 19win platform is intended exclusively for individuals aged 18 and over. Collecting and processing personal data from minors is strictly prohibited, and 19win takes active measures to prevent minors from registering or using the platform:

• Date of birth verification at registration with automatic blocking for users under 18;
• CPF verification, which includes age validation against available databases;
• KYC process that confirms the account holder is of legal age through official government-issued ID verification;
• Monitoring of usage patterns that may indicate access by a minor.

If 19win determines that personal data was inadvertently collected from a user under 18, the account will be immediately suspended, the data will be deleted from our systems as soon as possible, and any available balance will be processed in accordance with internal review. Parents or legal guardians who become aware that a minor has used the 19win platform should contact support immediately.

11. International Data Transfers

Some service providers used by 19win — particularly game providers such as Pragmatic Play, Evolution Gaming, and Spribe, which operate global infrastructure — may process data on servers located outside Brazil. When this occurs, 19win ensures that the transfer is carried out in compliance with LGPD requirements, specifically the provisions of Article 33 of the law, which requires that the destination country offer an adequate level of data protection or that sufficient contractual safeguards be in place (such as standard contractual clauses recognized by data protection authorities).

19win does not transfer personal data of Brazilian users to countries or organizations that do not offer protection compatible with LGPD standards without appropriate safeguards in place. If you have specific questions about international transfers of your data, please contact our DPO at the email address provided in Section 13 of this Policy.

12. Changes to This Privacy Policy

19win may update this Privacy Policy periodically to reflect changes in Brazilian legislation, our data processing practices, or platform features. Any update to this Policy will be communicated with a minimum notice of 7 days for material changes, through:

• Prominent notice on the 19win platform homepage;
• Email notification to the address registered on your account;
• A notice in your account dashboard on your first login after the changes are published.

The current version of this Policy will always be available on this page, with the date of the last update shown at the top of the document. Your continued use of the 19win platform after the effective date of any changes constitutes acceptance of the updated terms. If you do not agree with the changes, you may request account closure before the effective date by contacting live support.

13. Contact, DPO & Privacy Channel

To exercise your rights as a data subject, ask questions about this Policy, or report any concerns about how 19win handles your personal data, please use the channels below:

19win has appointed a Data Protection Officer (DPO), as required by Article 41 of the LGPD. The DPO is 19win's official point of contact with the National Data Protection Authority (ANPD) and with data subjects on all privacy-related matters. Requests addressed to the DPO should be sent to the email above with the subject line "Attn: DPO".

If you are not satisfied with 19win's response to a privacy request, or believe your rights have been violated, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), through the official ANPD portal on the Brazilian federal government website.