Privacy Policy of 939n: Your Data Protected

1Who We Are — The Data Controller

939n is the controller of the personal data processed under this Privacy Policy. We operate the Sports Betting and online casino platform accessible at 939n.net, as well as through the mobile app available for Android and iOS.

For the purposes of the General Data Protection Law (LGPD – Law No. 13.709/2018), 939n is the party responsible for deciding how and why your personal data is collected and used. Our Data Protection Officer (DPO) is available at privacidade@939n.net for any questions related to the processing of personal data.

By registering with 939n, you confirm that you have read and understood this Privacy Policy and agree to the processing of your data as described herein. 939n is committed to handling your data with transparency, respect, and security — because the trust of Brazilian players is the foundation of everything we build.

2Personal Data We Collect

2.1 Data You Provide Directly

When you register and use 939n, you provide us directly with the following personal data:

• Identification data: full name, CPF, date of birth, RG or CNH number (for identity verification);
• Contact details: email address, mobile number, full residential address including ZIP code;
• Financial data: registered Pix key (CPF, email, or phone number), credit or debit card details (stored in encrypted form by a PCI-DSS certified processor), and bank account information for wire transfers;
• Verification documents: photo ID, selfie for facial verification, and proof of address, when requested during the KYC process.

2.2 Automatically Collected Data

When you access and use the 939n platform — whether via the website or the app — we automatically collect:

• Device data: device type, operating system, app version, and unique device identifier (required for multiple-account detection and fraud prevention);
• Connection data: IP address, approximate location derived from IP, internet service provider, and session times and durations;
• Browsing data: pages visited within the platform, games played, betting markets browsed, and time spent in each section;
• Transaction data: complete history of deposits, withdrawals, bets placed, winnings and losses, and bonuses activated and used.

2.3 Third-Party Data

In some cases, 939n may receive your data from external sources for specific purposes: from credit bureaus for identity verification and fraud prevention; from payment processors to confirm transactions; and from casino game providers for technical support and audit purposes.

3How We Use Your Personal Data

939n uses your personal data exclusively for the following purposes, each with a specific legal basis under the LGPD:

939n never uses your data for purposes incompatible with those listed above without obtaining your prior and explicit consent. If we wish to use your data for a new purpose, you will be informed and given the option to agree or not.

4Legal Basis for Data Processing

In accordance with the LGPD, all personal data processing carried out by 939n is based on a specific legal ground. The legal bases that underpin our processing activities are:

• Performance of a contract (art. 7, V): data required to provide the betting, casino, and payment services you contracted when registering with 939n;
• Legal or regulatory obligation (art. 7, II): data processed to fulfill obligations imposed by Brazilian law, including anti-money laundering rules, customer identification requirements, and reporting to regulatory authorities;
• Legitimate interest (art. 7, IX): data processed for fraud prevention, platform security, experience personalization, and service improvement — always respecting your fundamental rights;
• Consent (art. 7, I): data processed to send marketing communications, newsletters, and personalized promotions — you may withdraw this consent at any time with no penalty.

5Data Sharing with Third Parties

939n does not sell your personal data. Sharing is limited to the situations below, each with a specific purpose and appropriate contractual safeguards:

5.1 Service Providers (Operators)

939n shares data with companies acting as data processors to provide services on our behalf, including:

• Payment processors: PCI-DSS certified companies that process transactions via Pix, credit/debit card, and other methods accepted by 939n. They receive only the data necessary to process each transaction;
• Casino game providers: companies such as Pragmatic Play, Evolution Gaming, and PG Soft receive an anonymous player identifier (not your CPF or full name) for the technical operation of games;
• Identity verification services (KYC): specialized companies that assist with document verification and fraud prevention, receiving only the data necessary for each verification;
• IT infrastructure and hosting: cloud and hosting service providers that store data on secure servers, subject to contractual data protection agreements.

5.2 Public Authorities

939n may share your data with Brazilian public authorities when required by law or court order, including: the Receita Federal do Brasil, COAF (Conselho de Controle de Atividades Financeiras), the Federal Police, the Public Prosecution Service, and betting sector regulators. In such cases, we share only the data specifically requested and strictly necessary.

5.3 What We Never Do

• We never sell your personal data to third parties;
• We never share your data with advertisers or marketing companies without your explicit consent;
• We never transfer complete financial data (card number, password) to any third party — this data is processed directly by certified payment processors.

6Data Storage and Security

6.1 Where Your Data Is Stored

Personal data processed by 939n is stored on servers located in Brazil and/or in countries that offer an adequate level of protection as assessed by the ANPD. All servers use encryption at rest (AES-256) and in transit (TLS 1.3), with regular backups and disaster recovery plans that are periodically tested.

6.2 Security Measures in Place

939n applies a comprehensive set of technical and organizational measures to protect your data:

• 256-bit SSL/TLS encryption on all communications between your device and the platform;
• Two-factor authentication (2FA) available to all players;
• Role-based access control (RBAC) — only staff with a specific need can access players' personal data;
• Continuous security monitoring with incident detection and response systems (SIEM);
• Penetration testing (pentest) conducted periodically by specialized firms;
• Mandatory security and privacy training for all 939n staff;
• Pseudonymization of data used in development and testing environments.

7Data Retention and Deletion

939n retains your personal data only for as long as necessary for each purpose, in accordance with mandatory legal retention periods:

• Active account data: kept for as long as your 939n account remains active;
• Financial transaction data: retained for at least 5 years after account closure, as required by Brazilian anti-money laundering legislation and tax obligations;
• Identity verification data (KYC): retained for at least 5 years after account closure, as required by COAF regulations;
• Betting and gaming records: retained for 5 years for audit and dispute resolution purposes;
• Marketing data (with consent): deleted within 30 days of consent withdrawal, except where retention is required by legal obligation.

Once retention periods expire, your data is securely and irreversibly deleted or anonymized for statistical purposes. Anonymized data does not identify you individually and is not subject to LGPD regulations.

8Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a data subject, a robust set of rights that 939n is fully committed to upholding. You may exercise any of these rights through your account dashboard or by emailing privacidade@939n.net:

939n responds to all rights-exercise requests within 15 (fifteen) calendar days of receipt. In complex cases or those requiring additional verification, this period may be extended by a further 15 days, with prior notice to you. If you are not satisfied with our response, you have the right to file a complaint with the National Data Protection Authority (ANPD).

9Cookies and Tracking Technologies

9.1 What Cookies Are and How We Use Them

939n uses cookies and similar technologies on the website and app to ensure the platform works correctly and to improve your experience. The types of cookies used include:

• Essential cookies: required for the platform's core functionality — authentication, session security, and language preferences. They cannot be disabled without affecting functionality;
• Performance cookies: collect anonymous data about how you use the platform to help us identify technical issues and improve your experience. They do not identify you individually;
• Functionality cookies: remember your preferences on the 939n platform (such as your favorite game or odds settings) for a more personalized experience;
• Analytical cookies: used with your authorization for behavioral analytics, helping 939n understand which features are most valued by Brazilian players.

9.2 Cookie Management

You can manage your cookie preferences at any time through the cookie banner shown on your first visit to 939n, or via the account settings panel. Disabling non-essential cookies may limit some platform features, but will not prevent you from using the core services. 939n does not use cookies for cross-site behavioral tracking.

10International Data Transfers

In some cases, your data may be transferred to servers or service providers located outside Brazil — for example, international casino game providers or cloud infrastructure services. When this occurs, 939n ensures the transfer is carried out based on:

• An ANPD adequacy decision recognizing the country as offering a level of protection equivalent to Brazil's; or
• : standard contractual clauses approved by the ANPD, incorporated into contracts with international service providers; or
• Internationally recognized compliance certifications and seals (such as ISO 27001 and SOC 2 Type II).

In no case is your data transferred internationally for purposes incompatible with those described in this Privacy Policy. International game providers receive only pseudonymized identifiers — not your full personal data such as CPF or address.

11Users Under 18

939n services are intended exclusively for individuals aged 18 and over. 939n does not intentionally collect personal data from users under 18. If we determine that an account was created by a minor or that a minor's data was provided, we will take the following immediate steps:

• Permanent account closure;
• Deletion of all personal data belonging to the minor from our active systems;
• Refund of the deposited real balance to the identified legal guardian;
• Cancellation of all winnings obtained during the period of unauthorized use;
• Reporting to competent authorities when required by law.

12Marketing Communications and Notifications

With your consent, 939n may send communications about promotions, bonuses, platform updates, free bets on sporting events such as Brasileirão matches and UFC cards, and other content of interest to Brazilian players. These communications may be sent by email, SMS, in-app push notification, or WhatsApp.

12.1 How to Unsubscribe

You can opt out of any type of marketing communication at any time:

• Through your 939n account dashboard, under the "Communication Preferences" section;
• Clicking the unsubscribe link included in every marketing email we send;
• By replying "STOP" to any marketing SMS you receive;
• Disabling push notifications in your phone or app settings.

Marketing unsubscribe requests are processed within 48 hours. After that period, you will no longer receive communications in the unsubscribed category. Mandatory transactional communications — such as deposit confirmations, withdrawal notifications, and security alerts — will continue to be sent regardless of your marketing preferences, as they are necessary for the provision of contracted services.

13Security Incidents and Data Breaches

In the event of a security incident that may affect your personal data — such as unauthorized access, a data breach, or accidental destruction — 939n will follow this protocol:

• Immediate containment: technical measures are applied immediately to contain and neutralize the incident;
• Impact assessment: assessment of the incident's scope and potentially affected data, completed within 72 hours;
• Notification to the ANPD: incidents that may pose significant risk are reported to the National Data Protection Authority (ANPD) within the legally required timeframe;
• Notification to data subjects: if the incident poses a high risk to you, 939n will notify you directly by email with clear guidance on the protective steps to take.

14Changes to This Privacy Policy

939n may update this Privacy Policy periodically to reflect changes in data processing practices, regulatory updates, or improvements to our services. Any material change — one that affects your rights or how your data is handled — will be communicated at least 7 (seven) days in advance via your registered email and/or a prominent in-platform notification.

Minor changes — such as text corrections or section reorganization that do not affect the content — may be made without prior notice. The date of the last update to this Policy is always shown at the top of the document. The current version is always available on this page. If you disagree with the changes, you may request account closure before the effective date of the changes, with a refund of your available real balance.

15Contact, DPO & Privacy Channel

For any questions about how your personal data is processed or to exercise your rights as a data subject, you can reach 939n through the following channels:

• Privacy channel (DPO): privacidade@939n.net — for access, correction, deletion, portability, and other LGPD rights requests;
• General support: suporte@939n.net or 24/7 live chat within the platform — for account queries, payments, and general 939n support;
• Account dashboard: most privacy requests can be submitted directly through your account dashboard, under the "Privacy & Data" section.

939n's Data Protection Officer (DPO) is the official point of contact with the National Data Protection Authority (ANPD) and is available to answer your privacy questions within 15 calendar days. If you are not satisfied with 939n's response, you have the right to file a complaint directly with the ANPD through the authority's official website.