ccc9 Privacy Policy — Your Data Protected by the LGPD

1. Introduction

This Privacy Policy describes how ccc9 collects, uses, stores, shares, and protects the personal data of users of the ccc9.best platform. It applies to all visitors, registered users, and anyone who interacts with ccc9's services, including Sports Betting, slots, live casino, jackpots, and other available products.

Ccc9 takes player privacy seriously. We are not a platform that hides data collection practices in unreadable paragraphs. This policy was written to be read and understood — in plain language, spelling out exactly what we do with your information.

By creating a ccc9 account or continuing to use the platform after updates to this policy, you confirm that you have read and understood the terms set out here. This policy supplements and should be read together with the Terms and Conditions of ccc9.

2. Data Controller

The controller of personal data collected by the ccc9 platform is the entity responsible for operating the ccc9.best website. As the data controller, ccc9 determines the purposes and means by which personal data is processed, in accordance with the LGPD.

To exercise your rights as a data subject or to clarify any questions about how your information is processed, you may contact ccc9's data protection officer (DPO) through the channels listed in section 14 of this policy.

Ccc9's entire operation is aimed at Brazilian users, and the data collected is processed for the purpose of providing Sports Betting and online casino entertainment services to players residing in Brazil.

3. Data We Collect

Ccc9 only collects data that is necessary to operate the platform, process transactions, and fulfill legal obligations. Below are the categories of data we may collect:

Ccc9 does not collect unnecessary sensitive data, such as health information, religious beliefs, biometric data beyond what is needed for identity verification, or any other sensitive category unrelated to the platform's operation.

4. Purpose of Processing

Every piece of data collected by ccc9 has a specific, defined purpose. We do not use your data for anything beyond what is listed below:

• Service provision: create and manage your account, process bets, deposits via Pix or boleto bancário, withdrawals, and other platform operations;
• Identity verification (KYC): meet regulatory anti-money laundering obligations and confirm the user is 18 years of age or older;
• Communication: send notifications about your account, transactions, promotions (with your consent), and important platform updates;
• Security: detect and prevent fraud, unauthorized access, bonus abuse, and other illicit activity;
• Responsible gambling: monitor gaming patterns and activate protective tools when necessary, in accordance with our responsible gambling policy;
• Platform improvement: analyze usage behavior in aggregated, anonymized form to improve the player experience;
• Legal obligations: comply with determinations from competent authorities, court orders, and regulatory requirements applicable to the sector in Brazil.

5. Legal Basis (LGPD)

Ccc9 processes your personal data based on the following legal grounds established by the LGPD:

• Performance of a contract (art. 7, V): processing of registration, financial, and usage data is necessary to provide the services you signed up for when creating your ccc9 account;
• Compliance with a legal obligation (art. 7, II): data collected for identity verification, anti-money laundering, and compliance with regulatory authorities;
• Legitimate interest (art. 7, IX): technical and usage data for platform security and fraud prevention, in line with users' interests and rights;
• Consent (art. 7, I): sending marketing communications and promotions, for which we request your express consent, which may be withdrawn at any time.

6. Data Sharing

Ccc9 does not sell, rent, or transfer your personal data to third parties for commercial purposes. We may share information only in the following specific and limited cases:

• Service providers: companies that support the operation of the platform, such as payment processors (Pix, Mercado Pago, PicPay, card operators), IT infrastructure providers, and identity verification suppliers. These partners operate under contracts with data protection clauses and may not use your information for any other purpose;
• Game providers: slots, live casino, and other product providers receive only the minimum data required to run the games (such as a session identifier), without access to your full personal data;
• Legal obligation: public authorities, the Federal Revenue Service, regulatory bodies, and court orders, when required by law or judicial ruling;
• Fraud prevention: anti-money laundering and financial crime prevention bodies, as required by applicable regulations;
• With your consent: any other sharing not listed above will require your prior express consent.

All data sharing with third parties is governed by contractual agreements requiring LGPD compliance and prohibiting the use of that information for any purpose beyond what is strictly necessary.

7. Data Retention

Ccc9 retains your personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations. Retention periods vary by category:

• Registration and active account data: retained for as long as your account is active and for up to 5 years after closure, in accordance with anti-money laundering requirements;
• Financial and transactional data: kept for up to 10 years after the transaction, as required by Brazilian tax and regulatory obligations;
• Betting history: retained for up to 5 years for audit and regulatory compliance purposes;
• Technical data (logs, IPs): retained for up to 12 months for security and fraud investigation purposes;
• Support communication data: kept for up to 2 years for quality and compliance purposes.

Once retention periods expire, data is securely deleted or anonymized so that it can no longer be used to identify the individual.

8. Data Security

Ccc9 applies technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or improper disclosure. Key measures include:

• 256-bit SSL encryption on all communications between your device and the platform;
• Passwords are stored using one-way hashing — no ccc9 employee has access to your password in plain text;
• Role-based access control (RBAC) limiting data access to employees who need it to perform their duties;
• Continuous system monitoring for detection of intrusion attempts and suspicious activity;
• Periodic security audits conducted by internal teams and specialized third parties;
• Incident response plan with clear procedures for containing, investigating, and notifying in the event of a data breach.

Despite all measures in place, no system is 100% breach-proof. ccc9 recommends that you also follow personal security best practices, such as using a strong, unique password for your account and never sharing your credentials with anyone.

9. Cookies and Tracking Technologies

Ccc9 uses cookies and similar technologies to enhance your experience on the platform. Cookies are small text files stored on your device that allow ccc9 to recognize your session, save preferences, and analyze platform usage.

Types of cookies used by ccc9:

• Essential cookies: required for basic platform functionality, such as keeping you logged in during your session. They cannot be disabled without affecting how the site works;
• Preference cookies: store your settings and usage preferences, such as language and accessibility options;
• Analytical cookies: collect anonymized data on how users interact with the platform, used to identify improvements. Data is processed in aggregate form and does not allow individual identification;
• Security cookies: help detect suspicious behavior and fraud attempts on the platform.

You can manage cookie preferences in your browser settings. Disabling essential cookies may affect the normal functioning of the ccc9 platform.

10. Minors

The ccc9 platform is intended exclusively for users aged 18 and over. ccc9 does not knowingly collect data from minors and does not permit registration or use of its services by anyone under that age.

If ccc9 identifies that data from a user under 18 was inadvertently collected, that information will be deleted immediately and the associated account will be closed. If you believe a minor's data has been submitted to the platform, contact support immediately via 24/7 chat or at contato@ccc9.best.

11. Your Rights as a Data Subject

The LGPD gives you concrete rights over your personal data. ccc9 is committed to responding to all requests related to these rights within the deadlines established by law. You may request:

• Access: confirm that your data is being processed and receive a copy of the information ccc9 holds about you;
• Correction: request the update or correction of inaccurate, incomplete, or outdated data;
• Anonymization, blocking, or deletion: of data that is unnecessary, excessive, or processed in violation of the LGPD;
• Portability: receive your data in a structured format for transfer to another service or product;
• Sharing information: know which entities ccc9 has shared your data with;
• Consent withdrawal: withdraw your consent for processing activities based on consent, at any time;
• Objection: object to processing carried out on the basis of legitimate interest that disproportionately affects your rights.

To exercise any of these rights, contact ccc9's Data Protection Officer (DPO) through the channels described in Section 14. ccc9 responds to LGPD requests within 15 business days. In more complex cases, this period may be extended by the same amount of time, with prior notice to the data subject.

12. Security Incidents

Ccc9 maintains a security incident response plan with clear procedures for identifying, containing, investigating, and communicating any personal data breaches.

In the event of an incident that may pose a significant risk or harm to data subjects, ccc9 will take the following steps:

• Contain the incident and prevent further unauthorized access or disclosure of data;
• Investigate the origin, scope, and impact of the breach;
• Notify the National Data Protection Authority (ANPD) within the timeframe established by the LGPD;
• Notify affected individuals clearly and directly, informing them which data was involved, the associated risks, and the measures taken;
• Implement the necessary fixes to prevent recurrence.

If you suspect unauthorized access to your ccc9 account, contact support immediately via 24/7 chat. In urgent situations, your account may be preventively suspended to protect your balance and data.

13. Changes to This Policy

Ccc9 may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or the services offered. The most recent version will always be available at ccc9.best/privacy-policy, with the update date shown at the top of the page.

For significant changes that affect your rights or the way we use your data, ccc9 will notify players via their registered email at least 15 days before the new terms take effect.

Continued use of the platform after changes are published constitutes acceptance of the updated policy. If you do not agree with the changes, you may request account closure and data deletion before the new terms take effect.

14. Contact & DPO

To exercise your rights as a data subject, get answers about this Privacy Policy, or report any data protection concern at ccc9, please contact our Data Protection Officer (DPO):

• DPO Email: privacidade@ccc9.best
• General email: contato@ccc9.best
• Live chat: available 24 hours a day, 7 days a week, at ccc9.best

When submitting an LGPD request, please provide your full name, the CPF linked to your account, and a clear description of your request. ccc9 may ask for additional information to verify your identity before processing requests for data access, correction, or deletion.