Privacy Policy of 35m4 — Your Data Protected with Transparency

1Introduction & Data Controller

The 35m4 acts as controller of its users' personal data, as defined by the LGPD. This means 35m4 is responsible for decisions regarding how personal data is collected, used, stored, and disposed of, always within the purposes and legal bases described in this policy.

This Privacy Policy forms part of, together with the Terms & Conditions and the guidelines of Responsible Gambling, the complete agreement between the user and 35m4 regarding use of the platform. For questions or to exercise your rights, the contact channel is the email suporte@35m4.net.

2Data We Collect

The 35m4 collects only the data necessary to operate the platform and fulfill its legal obligations. The categories of data collected are:

Identification & registration data:

• Full name, date of birth, CPF, and nationality.
• Email address and mobile phone number.
• Full residential address (street, neighborhood, ZIP code, city, state).
• Identity documents submitted during KYC: RG, CNH, passport, or proof of address.

Financial and transaction data:

• Pix key and banking details required to process deposits and withdrawals.
• Transaction history — deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers.
• Credit or debit card data (stored in tokenized form — 35m4 never stores the full card number on its servers).
• Full betting history — sports, casino, slots and all other categories.

Usage & browsing data:

• IP address, device type, operating system, and browser used.
• Session data — access times, pages visited, session duration, clicks, and in-platform interactions.
• Gaming preferences, account settings and communication history with 35m4 support.
• Approximate location data inferred from IP address (we do not track GPS or precise device location).

Communication data:

• Content of conversations with support via live chat or email.
• Communication preferences — opt in or opt out of promotional emails and notifications.

3How We Use Your Data

The data collected by the 35m4 are used exclusively for the following purposes:

• Account management: create, manage, and maintain your active account on the platform, and process your login and security authentications.
• Transaction processing: process deposits via Pix, boleto, card, and other accepted methods; process withdrawals; record and resolve transaction disputes.
• Identity verification (KYC): verify your identity, confirm your age (minimum 18 years), and comply with anti-money laundering (AML) obligations.
• Service delivery: offer Sports Betting on football (Brasileirão, Copa do Brasil, Libertadores), MMA, UFC, volleyball, basketball and other sports, as well as Live Casino, slots, crash games and other products.
• VIP Program: calculate betting volume, determine VIP tier, process weekly cashback, and manage exclusive benefits such as reload bonuses and access to special tables.
• Customer support: handle support requests, resolve account issues, respond to bet disputes, and provide information about the platform.
• Security and fraud prevention: detect and prevent fraudulent activity, duplicate account creation, money laundering, match manipulation and other conduct prohibited by 35m4's Terms and Conditions.
• Responsible gambling: monitor gambling patterns to identify potentially risky behavior and trigger protective tools when necessary.
• Communications: send notifications about your account, transaction confirmations, security updates and, with your consent, information about 35m4 promotions and news.
• Product improvement: analyze usage patterns in aggregate and anonymized form to improve the platform experience, develop new features, and optimize technical performance.
• Legal obligations: comply with court orders, requests from competent authorities and regulatory obligations applicable to the betting sector in Brazil.

4Legal Basis for Processing

Every data processing operation carried out by 35m4 has a specific legal basis, as required by the LGPD. The legal bases used are:

• Contract performance (art. 7, V): processing is necessary to perform the contract you entered into with 35m4 when creating your account — including bet processing, deposits and withdrawals via Pix and other methods, and management of the VIP Program.
• Compliance with a legal obligation (art. 7, II): processing is necessary to fulfill legal obligations, such as anti-money laundering (AML) regulations, identity verification (KYC), and responses to regulatory authorities.
• Legitimate interest (art. 7, IX): for purposes such as fraud prevention, platform security, product improvement, and behavioral analysis for responsible gambling — provided these interests do not override your fundamental rights.
• Consent (art. 7, I): for sending marketing communications and promotions by email or push notification — you may withdraw this consent at any time without affecting any other 35m4 services.

5Data Sharing with Third Parties

The 35m4 does not sell, rent, or trade users' personal data. Data is shared only in the following situations and with the categories of partners listed below:

• Payment processors: financial institutions and payment gateways required to process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago and TED transfers. These partners receive only the data strictly necessary to complete the transaction and are contractually required to treat it with confidentiality.
• Technology providers: companies that provide hosting infrastructure, cloud storage, security tools, and fraud detection systems. All operate as data processors under 35m4's instructions and under appropriate data protection agreements.
• Identity verification providers: specialized KYC services that assist with document validation and CPF verification against official Brazilian databases.
• Casino game providers: live game, slots, and crash game providers receive only an anonymized session identifier — never your full personal data or financial details.
• Competent authorities: 35m4 may share data with regulatory bodies, law enforcement, or judicial authorities when required by law, court order, or when necessary to protect the legitimate rights of the platform and its users.

All third parties with whom 35m4 that receive shared data are contractually required to use it only for the specified purposes, to protect it with appropriate security measures, and to comply with the LGPD and other applicable regulations.

6Cookies & Tracking Technologies

The 35m4 uses cookies and similar technologies to ensure the platform functions correctly and to improve your experience. The types of cookies used are:

• Essential cookies: essential to the platform's operation — session authentication, account security, wallet state management, and language preferences. These cookies cannot be disabled without affecting your access to 35m4.
• Performance cookies: collect anonymous information about how users interact with the platform — which pages are visited most, where technical errors occur, and how load times can be improved. The data is aggregated and does not identify individual users.
• Functional cookies: remember your personal preferences — such as language, odds format, and display settings — so you do not have to reconfigure them every time you access 35m4.
• Security cookies: used by the anti-fraud system to identify suspicious access patterns, multiple logins from different locations and unauthorized account access attempts.

The 35m4 does not use advertising tracking cookies to sell user profiles to advertisers. You can manage your cookie settings through the preferences menu in your browser — however, disabling essential cookies will prevent normal access to the platform.

7Data Security

The 35m4 implements a robust set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure:

• Encryption in transit: all connections between your device and 35m4's servers are protected by 256-bit SSL/TLS encryption — the same security standard used by Brazil's leading digital banks.
• Encryption at rest: sensitive data stored on 35m4's servers — such as identity documents and financial data — is encrypted at rest using modern algorithms.
• Two-factor authentication (2FA): available to all users and strongly recommended to protect account access against unauthorized login attempts.
• Internal access controls: only 35m4 employees with a proven operational need have access to users' personal data, with a full log maintained of all accesses.
• Continuous monitoring: 35m4's security system monitors suspicious activity in real time — brute-force login attempts, access from unusual IPs, and atypical transaction patterns.
• Payment data tokenization: credit and debit card data is tokenized — 35m4 never stores the full card number on its servers. Transactions are processed by the payment gateway in a secure, isolated environment.
• Security testing: 35m4's infrastructure undergoes penetration testing (pentests) and periodic security audits carried out by independent specialized firms.

Despite all these measures, no system is 100% impenetrable. 35m4 recommends using a strong, unique password for your account and enabling two-factor authentication to maximize your protection. If you suspect unauthorized access, contact us immediately at suporte@35m4.net.

8Data Retention & Deletion

The 35m4 retains your personal data for as long as necessary to fulfill the purposes described in this policy or to meet legal obligations. Retention periods by category are:

• Active account data: retained for as long as your account remains active on 35m4. You may request account closure and data deletion at any time, subject to applicable legal retention periods.
• Financial transaction data: retained for up to 10 years after the last transaction, in accordance with Brazilian financial legislation and anti-money laundering (AML) regulations.
• KYC documents: retained for up to 5 years after account closure, in accordance with the regulatory obligations applicable to the betting sector.
• Betting history: retained for up to 5 years for dispute resolution and fulfillment of legal obligations.
• Browsing data and cookies: retained for up to 13 months after collection, in accordance with applicable guidelines.
• Support communications: retained for up to 3 years for reference in future disputes or claims.

Once retention periods expire, data is securely and irreversibly deleted, or anonymized for purely statistical and aggregate use, so that individual users can no longer be identified.

9Your Rights Under the LGPD

The LGPD grants you a set of rights over your personal data that 35m4 is committed to fully respecting. You may exercise any of these rights at any time:

• Right of access: confirm whether 35m4 processes your data and obtain a copy of the information we hold about you.
• Right to correction: request the update or correction of incomplete, inaccurate or outdated data.
• Right to anonymization or blocking: request the anonymization or blocking of data that is unnecessary, excessive, or processed in violation of the LGPD.
• Right to data portability: request the portability of your data to another service or product provider, in a structured, machine-readable format.
• Right to deletion: request the deletion of data processed on the basis of your consent. For data processed under other legal bases (such as contract performance or legal obligation), deletion may be subject to the mandatory retention periods described in the previous section.
• Right to information about data sharing: find out which third parties 35m4 shares your data with.
• Right to object: object to the processing of your data for specific purposes — such as direct marketing — where there is no mandatory legal basis.
• Right to withdraw consent: withdraw consent for processing based on that legal basis, such as receiving promotional emails from 35m4, without affecting the normal operation of your account.

To exercise any of these rights, contact us at suporte@35m4.net with the subject line "Exercise of LGPD Rights". The response deadline is up to 15 business days. If your request is not satisfactorily resolved, you may file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).

10Minors Under 18

The 35m4 is a platform intended exclusively to users aged 18 and over. 35m4 does not intentionally collect personal data from minors. The KYC process includes date-of-birth verification and confirms legal age before any withdrawal is approved.

If you are a parent, guardian or legal representative and suspect that someone under 18 has created an account on 35m4, please contact us immediately at suporte@35m4.net. The account will be investigated and closed immediately if the suspicion is confirmed, and all data relating to the minor will be deleted from our systems.

We recommend using parental control software to restrict children's and teenagers' access to betting platforms, including 35m4.

11International Data Transfer

To run the platform at the quality and availability you expect, the 35m4 may use server infrastructure and cloud services located outside Brazil. When personal data is transferred to other countries, 35m4 ensures that:

• Data transfers occur only to countries that provide a level of data protection adequate or equivalent to the LGPD, as assessed by the ANPD.
• Or that specific contractual data protection clauses are in place with data recipients, ensuring a level of protection equivalent to that required by the LGPD.
• All international vendors are subject to the same confidentiality and security obligations required of domestic partners.

The main infrastructure providers used by the 35m4 are internationally recognized companies known for their security and compliance standards — including providers certified under ISO 27001, SOC 2, and European GDPR.

12Changes to This Policy

The 35m4 may update this Privacy Policy periodically to reflect changes in data processing practices, new platform features, updates to Brazilian legislation — such as supplementary ANPD regulations — or other relevant factors.

Registered users will be notified of significant changes by email at least 7 calendar days before taking effect. Changes required by new legal obligations may take effect immediately, with simultaneous notice.

The "last updated" date shown at the top of this page will always indicate when the current version was published. We recommend reviewing this policy periodically. Continued use of the platform after changes have been communicated constitutes tacit acceptance of the updated version.

13Contact & Data Protection Officer (DPO)

The 35m4 has appointed a Personal Data Processing Officer (DPO — Data Protection Officer), as required by the LGPD for organizations that process personal data at scale. The DPO is responsible for ensuring the platform's compliance with the LGPD and for serving as the communication channel between 35m4, its users, and the ANPD.

To exercise your data subject rights, report privacy concerns, request clarification about this policy, or contact the DPO, please use the channels below:

• Email (privacy and DPO): suporte@35m4.net — with the subject "LGPD Rights Request" or "Privacy"
• Live chat: available directly on the platform, 24 hours a day, 7 days a week
• Response time: up to 15 business days for LGPD-related requests

If you are not satisfied with 35m4's response regarding the handling of your data, you have the right to file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados), the regulatory body responsible for enforcing the LGPD in Brazil.