888hh Privacy Policy – How We Protect Your Data

The controller of the personal data processed under this Privacy Policy is 888hh, an online casino and Sports Betting platform operated with an exclusive focus on the Brazilian market. For the purposes of the Lei Geral de Proteção de Dados Pessoais (LGPD – Law 13.709/2018), the controller is the entity that makes decisions about the processing of your data — what to collect, for what purpose, for how long, and with whom to share it.

The 888hh has appointed a Data Protection Officer (DPO) responsible for handling data subject requests and overseeing compliance with this policy. The DPO contact details are provided in Section 13 of this document.

The 888hh collects personal data in the following categories, depending on how you interact with the platform:

Data you provided directly during registration:

• Full name as shown on an official ID document.
• CPF (Cadastro de Pessoas Físicas).
• Date of birth.
• Email address.
• Mobile phone number with Brazilian area code (DDD).
• Full residential address including ZIP code (CEP).

Identity verification data (KYC):

• Copy of a government-issued photo ID (RG, CNH, or passport).
• Proof of residence issued within the last 90 days.
• Pix key ownership details registered for withdrawals.

Financial and transactional data:

• Deposit and withdrawal history via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfers.
• Payment method used in each transaction.
• Amounts and dates of all financial transactions on the account.

Platform usage and behavioral data:

• Sports betting history (football, MMA, UFC, volleyball, basketball, and others).
• Game session history (slots, live casino, crash games, blackjack).
• Duration and frequency of sessions on the platform.
• Game preferences and account settings.

Technical data collected automatically:

• IP address and approximate location data.
• Browser type and version, operating system, and device (mobile, tablet, desktop).
• Data from cookies and similar technologies as detailed in Section 6.
• Access logs with date, time, and actions performed on the platform.

The data collected by 888hh are used exclusively for the purposes listed below. No data is used for any purpose incompatible with the original reason for collection without your explicit consent:

The 888hh never uses personal data to build targeted advertising profiles for third parties or to sell user lists to external advertisers. Internal behavioral analysis is used solely to improve the platform experience and to identify situations that may indicate problem gambling for responsible gaming purposes.

Under the LGPD, all personal data processing must be grounded in a specific legal basis. The 888hh processes your data based on the following legal bases established by law:

• Contract performance — processing is necessary to fulfill the platform's terms of use that you agreed to upon registration, including account operation, processing deposits via Pix and boleto, withdrawals, and the provision of betting and casino services.
• Compliance with a legal obligation — some processing is required by law, such as anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and compliance with court or administrative orders.
• Legitimate interest — the 888hh may process data to prevent fraud and ensure the security of the platform and its users, provided that such interest does not override the fundamental rights of the data subject.
• Consent — for optional purposes, such as sending marketing communications and promotions via email or mobile, processing is based on your consent, which may be withdrawn at any time without affecting your normal use of the platform.
• Credit protection — in specific cases provided for by law, for financial risk analysis associated with high-value transactions.

When processing is based on consent, the 888hh always requests consent in a clear, specific, and unambiguous manner — with no pre-checked boxes or misleading language that could confuse the user.

The 888hh does not sell your personal data. Sharing occurs only in the situations below, strictly necessary for operating the platform or required by law:

• Payment providers — to process deposits and withdrawals via Pix, boleto bancário, cards, PicPay, Mercado Pago, and TED transfers from institutions such as Nubank, Itaú, Bradesco, and Banco do Brasil. These partners receive only the data necessary for the specific transaction and are bound by confidentiality agreements and LGPD compliance obligations.
• Game and technology providers — game studios integrated into the platform (such as slots providers, live casino, and crash games) may receive minimal technical data required to operate the games, without access to financial or full identification data.
• Government and Regulatory Authorities — when required by law, court order, money laundering investigation, or regulatory directive, the 888hh discloses data to the relevant authorities strictly within the limits required by the official request.
• Security and anti-fraud services — specialized partners in fraud detection, identity verification, and anti-money laundering may process data under contract with 888hh, with strict usage and confidentiality restrictions.

Under no circumstances is your data shared with direct marketing companies, data brokers, or advertisers without your explicit and clearly expressed consent.

The 888hh uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and — with your consent — for analytical purposes. The types of cookies used are:

• Essential cookies — required for the platform's basic functionality, such as maintaining your login session, storing language preferences, and keeping your betting slip active. These cookies cannot be disabled without impairing your use of the platform.
• Performance and analytics cookies — collect aggregated, anonymized information about how you use the platform (pages visited, session duration, clicks) to help us improve your experience. These cookies are only activated with your consent.
• Functionality cookies — store personalized preferences such as your favorite games, configured betting limits, and in-platform browsing history to streamline your experience on future visits.

You can manage your cookie preferences at any time through your browser settings. Disabling essential cookies may affect platform functionality — such as keeping you logged in and processing bets. The 888hh does not use third-party advertising cookies without explicit consent.

In addition to cookies, the platform may use technologies such as web beacons (tracking pixels) and browser local storage (localStorage) for technical platform functions. None of these technologies collect data beyond what is described in this policy.

The 888hh implements technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. Key measures in place include:

• 256-bit SSL Encryption across all communications between your device and 888hh's servers — including registration forms, Pix transactions, and gaming sessions.
• Two-factor authentication (2FA) available to all users in the account security settings.
• Internal access control with a principle of least privilege — only employees who require access to certain data to perform their role are granted that authorization.
• Continuous monitoring of access and suspicious activity across systems that store personal data, with automatic alerts triggered by unusual behavior.
• Security testing periodic assessments including vulnerability analyses and penetration testing carried out by a specialized team.
• Secure backups with encryption of stored data and regularly tested recovery procedures.

In the event of a security incident involving personal data that may cause significant risk or harm to data subjects, 888hh will notify the Autoridade Nacional de Proteção de Dados (ANPD) and affected users within the timeframes established by the LGPD, with details on the nature of the incident, the data involved, and the steps taken to mitigate it.

The 888hh retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to mandatory minimum legal retention periods. The general retention criteria are:

• Registration and identity data (KYC) — retained for the duration of the account and for at least 5 (five) years after closure, in accordance with anti-money laundering requirements and Brazilian tax legislation.
• Financial transaction history (deposits via Pix, boleto, card, and withdrawals) — retained for at least 5 (five) years after each transaction, in compliance with tax and regulatory obligations.
• Betting history and gaming sessions — retained for up to 3 (three) years after each session for support purposes, dispute resolution, and responsible gambling analysis.
• Access logs — retained for 6 (six) months, in accordance with the Brazilian Internet Civil Rights Framework (Law 12.965/2014), and may be extended by court order.
• Marketing communications data — retained while consent is active and for up to 6 months after withdrawal, for the purpose of documenting prior consent.

Once applicable retention periods expire, data is securely deleted or anonymized so that the individual can no longer be identified. User-requested deletions follow the same criteria — data subject to legal retention obligations cannot be deleted before the minimum period required by law.

The LGPD grants you, as the data subject whose personal data is processed by 888hh, the exercise of the following rights, which may be requested at any time through the Portuguese-language support channel:

The services of 888hh are intended exclusively for users aged 18 (eighteen) and over. The platform performs identity verification during registration to confirm all users are of legal age, and any accounts found to belong to users under 18 are closed immediately upon identification.

The 888hh does not intentionally collect personal data from users under 18. If you believe a minor has created an account or had their data collected improperly, please contact our support team immediately via live chat or at privacidade@888hh.best. Data will be deleted and the account closed as soon as the situation is confirmed.

Some of the technology and games providers partnering with 888hh may have servers located or operate in countries outside Brazil. In such cases, international data transfers are carried out only to countries that provide an adequate level of protection under the LGPD, or through specific contractual safeguards required by Brazilian law.

Among the safeguards in place for international transfers:

• Standard contractual data protection clauses incorporated into agreements with international vendors.
• Data protection impact assessments (DPIA) conducted prior to new integrations with vendors that process data in other countries.
• Data transferred to third parties is limited to the minimum necessary for that provider's specific service.

Brazilian payment providers — including those handling Pix, boleto bancário, PicPay, Mercado Pago, and TED transfers via Nubank, Itaú, Bradesco, and Banco do Brasil — operate exclusively within Brazilian territory and do not involve international data transfers.

The 888hh may update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or the services offered. Any significant update will be communicated at least 7 calendar days in advance via the registered email address and a prominent notice on the platform, before the new terms take effect.

The "Last updated" date shown at the top of this page is refreshed with every revision. We recommend reviewing this Policy periodically to stay informed about how your data is handled. Continued use of the platform after an update takes effect constitutes acceptance of the new terms.

If you disagree with any changes, you may request account closure before the new terms take effect, with your available real balance refunded via Pix to your registered key.

The 888hh has appointed a Data Protection Officer (DPO) responsible for handling data subject requests and ensuring compliance with this Privacy Policy and the LGPD.

To exercise your rights, ask questions about how your data is processed, or report any privacy concern, please reach out through the following channels:

• Privacy email: privacidade@888hh.best — for formal LGPD rights requests, with a response within 15 calendar days.
• General email: contato@888hh.best — for general questions related to the platform.
• Live chat: available 24 hours a day directly on the platform, staffed by a human team in Portuguese.
• WhatsApp: available to registered users via the support icon inside the platform after logging in.

Rights requests received by email are processed by the compliance team at 888hh within the legal deadline of 15 calendar days. For complex requests requiring additional review, you will be notified of any necessary extension within the first 5 business days of receipt.