Jj99 Privacy Policy — How We Protect Your Personal Data

1 Who We Are and How We Fit Under the LGPD

Jj99 is a Sports Betting and online casino platform operating in the Brazilian market, available at jj99.world. For the purposes of the General Data Protection Law (LGPD — Law No. 13.709/2018), jj99 acts as controller of its users' personal data — meaning jj99 is the entity that determines how and why that data is processed.

This policy applies to all personal data collected in connection with the jj99 platform: account registration, deposits and withdrawals via Pix or other Brazilian payment methods, Sports Betting (Brasileirão, Copa do Brasil, Libertadores, UFC, Superliga de Vôlei, NBB, and others), casino games (slots, crash games, Live Casino), use of the app, and communications with support.

Jj99 has appointed a Data Protection Officer (DPO), who can be reached at suporte@jj99.world with the subject line "DPO / LGPD". This officer is the official point of contact for all privacy and personal data protection matters.

2 What Data We Collect and How

2.1 Data You Provide Directly

When you create an account or use jj99, you provide us directly with:

• Identification data: full name, CPF, date of birth, nationality;
• Contact details: email address, phone number, residential address;
• Verification documents (KYC): National ID, driver's license, or passport with photo, proof of address;
• Financial data: Pix key, credit/debit card details (stored in tokenized form), bank account information for TED transfers (Nubank, Itaú, Bradesco, Banco do Brasil, and others);
• Communication data: conversation history with support via live chat or email.

2.2 Data Collected Automatically

When you browse the jj99 platform — whether on a mobile browser or desktop — we automatically collect:

• Access data: IP address, browser type and version, operating system, device identifier;
• Browsing data: pages visited, session duration, clicks, and navigation flow within the platform;
• Approximate location data: inferred from IP address for geographic compliance purposes;
• Betting and gaming behavior data: betting frequency, amounts wagered, categories selected (football, MMA, slots, live casino, crash games), and usage times.

2.3 Third-Party Data

In specific circumstances, jj99 may receive your data from authorized third parties, such as identity verification providers, credit bureaus for KYC confirmation, or payment partners like PicPay and Mercado Pago. This data is used solely for the purposes described in this policy and only where there is a valid legal basis.

3 How We Use Your Data

Jj99 uses the data it collects exclusively for the following purposes:

• Account creation and management: registration, eligibility verification, access authentication, password recovery;
• Identity verification (KYC): confirmation that the user is over 18 years of age, a resident of Brazil, and the rightful owner of the documents provided;
• Payment processing: deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfer;
• Platform operation: processing Sports Betting wagers, event settlement (Brasileirão, Copa do Brasil, Libertadores, UFC, NBB, Superliga), and execution of casino games and crash games;
• Responsible gambling: monitoring of behavioral patterns to identify signs of problem gambling and trigger protective tools when needed;
• Fraud and money laundering prevention: suspicious transaction analysis, detection of multiple accounts, and compliance with Brazilian anti-financial crime regulations;
• Customer support: responding to user questions, complaints, and requests via live chat or email;
• Marketing communication: sending promotions, updates, and personalized offers via email or notifications — always with the option to unsubscribe at any time;
• Legal compliance: compliance with obligations imposed by Brazilian law, including the LGPD, Central Bank regulations, and any applicable Sports Betting market rules.

Jj99 does not use your data to build profiles for sale, does not carry out automated decisions that produce legal or equivalent effects without human oversight, and does not use betting data to influence odds or event outcomes.

4 Legal Basis for Data Processing (LGPD)

The LGPD requires that all data processing have a defined legal basis. At jj99, each category of use has its own specific legal basis:

• Performance of a contract (art. 7, V): data used to create your account, process payments via Pix, and execute bets and games is necessary to fulfill the service agreement between you and jj99;
• Compliance with a legal obligation (art. 7, II): KYC verification, retention of financial records, and compliance with anti-money laundering regulations are based on legal obligations;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, responsible gambling, and internal product analytics are processed under jj99's legitimate interest, always respecting your rights;
• Consent (art. 7, I): marketing communications by email or push notifications are carried out based on your express consent, which can be withdrawn at any time in your account settings.

5 Data Sharing with Third Parties

5.1 Who We Share Data With

Jj99 may share your data with third parties only in the following situations and categories:

• Payment providers: Pix (Banco Central), card networks (Visa, Mastercard), PicPay, Mercado Pago, and Brazilian banks receive the data necessary to process each transaction. These providers have their own privacy policies and are regulated by the Banco Central do Brasil;
• Identity Verification (KYC) Providers: specialized partners in document validation and fraud prevention who assist in the account verification process. These providers act as data processors and are bound by a confidentiality agreement with jj99;
• Game providers: PG Soft, Pragmatic Play, Evolution Gaming, Spribe, and other casino providers receive only the minimum data required to run game sessions (user identifier and available balance). These providers do not receive your CPF, address, or full financial details;
• Competent authorities: when required by law, court order, or legitimate request from Brazilian authorities (Receita Federal, Polícia Federal, Ministério Público), jj99 shares the requested data. Whenever legally permitted, the user is notified of such requests;
• Auditors and consultants: audit, legal, and compliance professionals who access only the data strictly necessary for their roles, under contractual confidentiality obligations.

5.2 What We Don't Do

Jj99 never shares your personal data with third parties for commercial purposes without your explicit consent. We do not sell email lists, do not share data with external advertising networks, and do not share betting behavior information with sports brands, teams, or any entity beyond the categories listed above.

6 Data Storage & Security

6.1 Where Data Is Stored

Jj99 user data is stored on servers with bank-grade security infrastructure, with regular backups and geographic redundancy. jj99 implements all technical and organizational measures required by the LGPD to protect data against unauthorized access, accidental or unlawful destruction, loss, alteration, or disclosure.

6.2 Technical Security Measures

• 256-bit SSL/TLS encryption on all communications between the user and the platform;
• Passwords stored with cryptographic hashing — jj99 never stores your password in plain text and never has access to your actual password;
• Card financial data stored in tokenized format, with jj99 having no access to the full card number;
• Internal access control based on the principle of least privilege — staff only access the data required for their specific roles;
• Continuous monitoring of access and suspicious activity across platform systems;
• Two-factor authentication (2FA) available to all users in account settings.

6.3 In the Event of a Security Incident

If jj99 identifies any security incident that could compromise user data, it will act immediately to contain the incident and, where required by the LGPD, will notify affected users and the National Data Protection Authority (ANPD) within the legally prescribed timeframes — within 72 hours for notification to the ANPD. Users will be notified by email with details about what occurred, which data was affected, and what measures were taken.

7 Cookies and Tracking Technologies

7.1 What Are Cookies

Cookies are small text files stored on your phone or computer when you access jj99. They allow the platform to remember your preferences, keep your session active, and function properly.

7.2 Types of Cookies Used by jj99

• Essential cookies: required for the platform's basic functionality — keeping your session active after login, remembering your account balance, and processing bets. These cannot be disabled without affecting your ability to use jj99;
• Preference cookies: store your display settings, language, and notification preferences. They can be managed in your browser settings;
• Analytical cookies: used to understand how users navigate the platform — which sections are accessed most, where friction occurs, and which features are used most often. Data is analyzed in aggregated, anonymized form;
• Security cookies: help identify suspicious behavior, unauthorized access attempts, and fraud patterns. They are an essential part of jj99's protection system.

7.3 How to Manage Cookies

You can configure your browser to block or delete cookies at any time. However, blocking essential cookies may prevent jj99 from functioning properly — including login and bet processing. For non-essential cookies, preferences can be adjusted in your account settings panel.

8 Your Rights as a Data Subject (LGPD)

The LGPD grants you, as the data subject whose personal data is processed by jj99, the following rights:

To exercise any of these rights, contact us at suporte@jj99.world with the subject line "LGPD Rights — [describe your request]". jj99 responds to all requests within 15 business days. In complex cases, this period may be extended by a further 15 days, with notice to the user explaining the reason for the extension.

If you believe jj99 is not handling your data appropriately, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), available at gov.br/anpd.

9 How Long We Keep Your Data

Jj99 retains personal data only for as long as necessary to fulfill the purpose for which it was collected or to meet legal obligations. The retention criteria are:

• Active account data: retained for as long as the account remains active. After the user closes the account, data is anonymized or deleted within 30 days — except where retention is required by law;
• Financial and betting records: retained for 5 years after the transaction date, in accordance with the tax and compliance requirements of the Banco Central and Receita Federal of Brazil;
• KYC verification documents: retained for 5 years after account closure, in accordance with anti-money laundering regulations (Law No. 9,613/1998);
• Support communication records: retained for 2 years for quality assurance and dispute resolution purposes;
• Anonymized behavioral data: may be retained indefinitely for statistical purposes and platform improvement, provided individual users cannot be identified.

Once the applicable retention period has passed, data is securely and irreversibly deleted from jj99's systems.

10 Minors

Jj99 is a platform exclusively for individuals aged 18 and over. The collection of data from minors is strictly prohibited and is not intentional under any circumstances.

Jj99 takes active measures to prevent minors from registering: date of birth verification at sign-up, CPF validation against authorized databases, and document verification during the KYC process. If jj99 identifies that data from a user under 18 was inadvertently collected, that data will be deleted immediately and the account will be closed, with any remaining balance returned to verified legal guardians.

If you are the guardian of a minor and suspect they have created an account on jj99, please contact us immediately at suporte@jj99.world. The matter will be handled as a priority and with full confidentiality.

11 Changes to This Privacy Policy

Jj99 may update this Privacy Policy periodically to reflect changes in Brazilian law, platform operations, or industry best practices. Significant changes will be communicated at least 7 days in advance via email and a prominent notice on the platform.

The latest version of this policy will always be available on this page, with the last updated date shown at the top. Continued use of the jj99 platform after a new version takes effect constitutes acceptance of the changes. If you disagree with the updates, you may close your account before the effective date by contacting our support team.

12 Contact, DPO & How to Exercise Your Rights

For any questions related to this Privacy Policy, the processing of your personal data, or the exercise of your rights under the LGPD, please contact jj99 through the channels below:

• General email: suporte@jj99.world — for general privacy questions and data requests, with a response time of up to 15 business days;
• DPO (Data Protection Officer) Email: suporte@jj99.world with the subject line "DPO / LGPD" — for the formal exercise of rights under the LGPD;
• Live chat: available 24 hours on the jj99 platform for quick questions about privacy and data protection.

For complaints not resolved internally, Brazilian users may contact the National Data Protection Authority (ANPD) and other consumer protection bodies, such as the Procon in their state. jj99 is committed to cooperating with all legitimate oversight and mediation processes.

Also read the Terms and Conditions and the Responsible Gambling from jj99 to get a full picture of the rights and obligations governing your relationship with the platform.