Privacy Policy f5555 — Your Data With You

1. What Personal Data f5555 Collects

1.1 Data You Provide Directly

When you create your f5555 account and use the platform's services, you provide us with the following personal data:

• Identification data: full name, CPF, date of birth, gender (optional).
• Contact details: email address, mobile phone number with area code.
• Address data: ZIP code, street address, number, neighborhood, city, state — collected for identity verification and regulatory compliance purposes.
• Payment data: Pix keys, credit or debit card details (tokenized, never stored in plain text), and bank accounts used for TED transfers with banks such as Nubank, Itaú, Bradesco, and Banco do Brasil.
• Identity documents: copies of national ID, driver's license, or passport and proof of address, requested during the identity verification (KYC) process.

1.2 Automatically Collected Data

By accessing and using the f5555 platform, we automatically collect:

• Access and device data: IP address, browser type and version, operating system, device model, device identifier.
• Usage data: pages visited, games accessed, session time, clicks, and in-platform navigation.
• Location data: approximate location derived from IP address, for geographic eligibility verification purposes.
• Log data: login, logout, failed access attempts, and account change records.

1.3 Gaming Activity Data

Operating the f5555 platform requires storing gambling activity data, including:

• Complete history of bets placed, amounts, outcomes, and dates.
• Deposit and withdrawal history, including amounts, dates, and methods used.
• VIP points accumulated and current level in the VIP Program.
• Bonuses received, used, and expired.
• Gambling limits set by the user.

2. How We Use Your Data

Personal data collected by f5555 is used exclusively for the following purposes:

F5555 does not use your personal data for purposes incompatible with those listed above. If we intend to expand the scope of processing, you will be notified in advance and, where required, we will request your consent again.

3. Legal Bases for Data Processing

Under the LGPD, all personal data processing must be grounded in a legal basis. f5555 relies on the following legal bases depending on the purpose of the processing:

• Contract performance (Art. 7, V): processing is necessary to fulfill the contract entered into when you created your account — without this data, we are unable to operate your account, process your bets, or handle deposits and withdrawals.
• Legal obligation (Art. 7, II): certain data collection and retention is required by law — including identity verification (KYC), anti-money laundering (AML) records, and compliance with any applicable regulatory obligations in Brazil's Sports Betting sector.
• Legitimate interest (Art. 7, IX): used for activities such as fraud prevention, platform security, suspicious behavior analysis, and service improvement — always assessed to ensure it does not override the fundamental rights and freedoms of the data subject.
• Consent (Art. 7, I): for processing activities not essential to account operation, such as sending marketing communications by email or SMS. Consent is always requested in a clear, granular, and revocable manner.

4. Sharing Data with Third Parties

F5555 does not sell your personal data. Sharing with third parties only occurs in the situations below, with partners who are bound by contractual confidentiality and security obligations:

• Game providers: to operate the games available on the platform (minimum data required to identify the player within the game context). Partners such as Evolution Gaming, Pragmatic Play, and Microgaming receive only the account identifier — never full CPF or address details.
• Payment processors: to process deposits and withdrawals via Pix, bank slip, credit and debit cards, PicPay, and Mercado Pago. Financial data is transmitted with encryption, and processors are contractually prohibited from using this data for any other purpose.
• Identity verification services: KYC partners who perform CPF validation, document checks, and anti-money laundering list screening as required by law.
• IT Infrastructure: server providers, cloud storage, and cybersecurity services that process data as sub-processors, under contract and acting solely on f5555's instructions.
• Public authorities: when required by law, court order, or a determination by a competent regulatory authority — f5555 does not voluntarily disclose data to authorities without a specific legal basis.

5. How Long We Keep Your Data

F5555 retains personal data for as long as necessary to fulfill the purposes for which it was collected, in accordance with the minimum retention periods required by Brazilian law:

• Active account data: retained for the full duration of your f5555 account and for the periods specified below after account closure.
• Financial transaction data: retained for a minimum of 5 (five) years after the transaction, as required by anti-money laundering legislation and financial regulations.
• KYC data (identity documents): retained for a minimum of 5 (five) years after account closure, in accordance with AML obligations.
• Access and security logs: retained for 6 (six) months, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014).
• Marketing data (consent): retained until consent is withdrawn or the account is closed, whichever comes first.
• Betting history and gaming activity: retained for 5 (five) years for responsible gambling, audit, and regulatory compliance purposes.

Once the applicable retention periods have expired, data is securely deleted or anonymized so it can no longer be linked to you as an identifiable individual.

6. Security Measures Applied by f5555

F5555 employs a robust set of technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, improper disclosure, or destruction:

• Encryption in transit: all communication between your phone or computer and f5555's servers is protected by TLS/SSL with 256-bit encryption.
• Encryption at rest: sensitive data stored — including KYC documents and financial data — is encrypted at rest on the platform's servers.
• Two-factor authentication (2FA): available to all users and recommended during sign-up. 2FA protects account access even if your password is compromised.
• Payment data tokenization: credit and debit card data is never stored in plain text. f5555 uses tokenization through PCI-DSS certified processors, ensuring that actual card data never passes directly through our servers.
• Least-privilege access control: f5555 staff members only have access to the data necessary for their specific roles. No employee has unrestricted access to the full user database.
• Continuous monitoring: automated intrusion detection and anomalous behavior monitoring systems watch the platform around the clock to identify and respond to unauthorized access attempts.
• Regular security testing: f5555 conducts regular penetration tests and security audits to identify and fix vulnerabilities before they can be exploited.

7. How to Exercise Your Rights

You may exercise any of the personal data rights described in the previous section of this Policy through the following channels:

• f5555 account dashboard: go to Settings > Privacy to request access, correct your registration data, and manage your communication preferences directly.
• Email the DPO: send your request to privacidade@f5555.click with the subject line "Exercise of LGPD Right — [type of right]". Include your full name and CPF so we can verify your identity before processing the request.
• Live chat: contact f5555 support via the 24/7 chat available on the platform. The agent will forward your request to the DPO as a priority.

The response deadline is 15 business days from the confirmation of your identity. In more complex cases requiring in-depth legal or technical review, we may extend the deadline by up to 15 additional days, with prior notice explaining the reason for the extension.

If your request is denied — for example, when data retention is required by legal obligation — you will receive a reasoned explanation. If you disagree with the decision, you may appeal to the National Data Protection Authority (ANPD).

8. Use of Cookies and Similar Technologies

F5555 uses cookies and similar technologies (such as tracking pixels and local storage) to operate and improve the platform. The cookies used fall into the following categories:

• Essential cookies (always active): required for the platform's basic functionality — login, session management, security, and core preferences. These cannot be disabled without impairing your use of f5555.
• Performance cookies (opt-in): collect anonymized data about how you browse the platform to help us identify errors and improve the experience. They do not identify you individually.
• Functional cookies (opt-in): store your gaming preferences, language, and interface settings so they don't need to be reconfigured every session.
• Analytical cookies (opt-in): used for aggregated traffic and usage behavior analysis — data is always anonymized before any analysis takes place.

You can manage your cookie preferences via the banner displayed on your first visit to the platform or, at any time, through your account's privacy settings. Disabling non-essential cookies does not affect the core functionality of your f5555 account.

9. Protection of Minors

F5555 is a platform exclusively for adults. Access, registration, and use of any service on the platform is strictly prohibited for individuals under 18 (eighteen) years of age. f5555 does not knowingly collect personal data from anyone under 18.

During the identity verification (KYC) process, date of birth and identity documents are checked to confirm that users are of legal age. Accounts created by or for users under 18 are immediately closed upon identification, and any collected data is deleted.

If you are a parent or legal guardian and believe a minor under 18 has created an account on f5555, please contact us immediately at privacidade@f5555.click or via live chat. We will act urgently to close the account and delete all associated data.

10. International Data Transfers

Some of the technology and service providers used by f5555 may be located outside Brazil or may process data on international servers. When this occurs, f5555 ensures that all international data transfers comply with the requirements of the LGPD, specifically:

• Transfers to countries that the ANPD recognizes as providing an adequate level of data protection.
• Transfers covered by standard contractual clauses that establish data protection obligations equivalent to those of the LGPD for the overseas processor.
• Transfers to internationally recognized compliance certifications (such as ISO 27001 or SOC 2 Type II).

Under no circumstances will your data be transferred to jurisdictions that lack adequate data protection safeguards. For specific information about which providers process data outside Brazil and the applicable safeguards, please contact f5555's DPO at privacidade@f5555.click.

11. Data Protection Officer (DPO)

F5555 has appointed a Data Protection Officer (DPO) responsible for overseeing the platform's privacy practices, handling data subject requests, and serving as the point of contact with the National Data Protection Authority (ANPD).

To contact the f5555 DPO:

• Email: privacidade@f5555.click
• Recommended subject line: "LGPD Rights Request" or "Privacy Inquiry — f5555"
• Response time: up to 15 business days for rights requests; up to 5 business days for general inquiries

12. Changes to this Privacy Policy

F5555 may periodically update this Privacy Policy to reflect changes in the services offered, applicable legislation, or our data processing practices. When that happens:

• The "last updated" date at the top of this document will be revised.
• Material changes — those that significantly affect your rights or our obligations — will be communicated by email to the address registered on your f5555 account at least 7 days in advance.
• A notification will be displayed on the platform at your next login following the publication of any material changes.

Continued use of the platform after the effective date of any new provisions will constitute tacit acceptance of the changes. If you do not agree with the changes, you may close your account before the effective date and request a withdrawal of any available balance.

For changes that require new consent — such as expanding marketing purposes — f5555 will request your active confirmation before processing data under the new purpose.