Privacy Policy of 57aa – LGPD & Data Protection

1. Who we are and how to contact us

The 57aa, operated in 57aa.best, is the controller of the personal data processed under this Privacy Policy. As the data controller, 57aa is responsible for defining the purposes and means of processing users' personal data, in accordance with the LGPD.

For any questions, requests, or to exercise your personal data rights, you can reach our team through the following channels:

• Live chat: available 24 hours a day, 7 days a week, directly on the platform.
• Email: suporte@57aa.best — responses within 2 business days for general inquiries and up to 15 business days for formal LGPD requests.

57aa has a designated Data Protection Officer (DPO), responsible for handling communications from data subjects and the ANPD, and for ensuring internal compliance with this policy.

2. What Data We Collect

The 57aa collects only the data necessary for each specific purpose. Below are the categories of data we process:

Registration data

• Full name as it appears on an official document.
• CPF (Cadastro de Pessoas Físicas).
• Date of birth.
• Email address.
• Mobile phone number.
• Full residential address (zip code, street, city, state).

Identity verification data (KYC)

• A copy of an official photo ID (RG, CNH, or passport).
• Verification selfie for basic biometric comparison.
• Proof of address in the account holder's name.

Platform Usage Data

• Sports betting history — Brasileirão, Copa do Brasil, Libertadores, MMA, and UFC.
• Live Casino session history, crash games, and slots.
• Balance, deposits, and withdrawals made.
• Gaming preferences and browsing behavior within the platform.

Technical and browsing data

• IP address and approximate geolocation.
• Device type, operating system, and browser.
• Session cookies and device identifiers.
• Access logs with date, time, and actions performed on the platform.

Financial data

• Pix key registered for withdrawals.
• Partial credit or debit card details (last 4 digits and card brand only — never the full card number).
• Financial transaction history on the platform.

3. How We Use Your Data

Each piece of data collected by the 57aa has a defined purpose. We do not process data generically or without a specific goal. The purposes are as follows:

Platform operation

To create and manage your account, process bets, settle results, handle deposits via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED, and ensure your account balance accurately reflects every transaction.

Identity verification and fraud prevention

To confirm that each user is who they claim to be, that they are at least 18 years old, and to detect and prevent irregular activity such as duplicate accounts, bonus abuse, money laundering, and match fixing. A 57aa uses automated behavioral analysis tools to identify suspicious usage patterns.

Compliance with legal obligations

To meet Brazilian regulatory requirements — including tax obligations, reporting to COAF (Financial Activities Control Council) in cases of suspicious transactions, and responding to judicial or administrative orders from competent authorities.

Communication and support

To send account-related communications — security alerts, transaction confirmations, support replies — and, with your consent, marketing communications about promotions, bonuses, and platform news such as Brasileirão, Copa do Brasil, and Libertadores updates.

Platform improvement

To analyze aggregate usage patterns and improve the platform experience — load speed, betting market layout, mobile interface, and new features. These analyses use anonymized data wherever possible.

4. Legal Basis for Processing (LGPD)

The LGPD requires each instance of data processing to have a specific legal basis. See which legal bases 57aa uses for each processing category:

• Contract performance (art. 7, V): processing necessary to perform the service agreement you accepted at registration — creating your account, processing bets, and paying out winnings via Pix.
• Compliance with a legal obligation (art. 7, II): processing required by law — identity verification (KYC), regulatory reporting, compliance with judicial orders.
• Legitimate interest (art. 7, IX): fraud prevention, platform security, and suspicious behavior analysis — provided this does not override your fundamental rights.
• Consent (art. 7, I): sending marketing communications and using non-essential cookies. You may withdraw this consent at any time in your account settings or by contacting support.

5. Sharing data with third parties

The 57aa does not sell, rent, or trade users' personal data with third parties for advertising or any other commercial purpose. Data sharing is limited to the following situations:

Operational partners

Technology providers acting as data processors on behalf of 57aa — including Pix payment processors, live casino platforms (such as Pragmatic Play and SmartSoft), identity verification (KYC) services, and cloud infrastructure providers. These partners process data exclusively in accordance with 57aa's instructions and are contractually bound to uphold confidentiality and comply with the LGPD.

Legal and regulatory obligations

When required by law, court order, request from a competent authority, or to fulfill Brazilian regulatory obligations — such as reporting to COAF or the Receita Federal. In these cases, 57aa shares only the data strictly necessary to comply with the requirement.

Rights protection

In cases of substantiated suspicion of fraud, abuse, money laundering, or any illicit activity carried out through the platform, 57aa may share relevant data with competent law enforcement, judicial, or regulatory authorities.

6. Data retention and deletion

The 57aa retains your personal data only for as long as necessary for each specific purpose. The general retention periods are as follows:

• Registration and KYC data: kept for the duration of the account and for up to 5 years after account closure, as required by anti-money laundering legislation and financial compliance obligations.
• Betting and financial transaction history: maintained by 5 years for tax and regulatory purposes.
• Access logs and technical data: retained for up to 6 months, except where required for an ongoing security incident investigation or active dispute.
• Support communication data: retained for up to 2 years for quality assurance and dispute resolution.
• Data collected based on consent for marketing purposes: deleted within 30 days of consent withdrawal.

Once the applicable retention period expires, data is securely deleted or anonymized in a way that no longer allows identification of the holder. You may request early deletion of your data when there is no legal basis requiring its retention — reach out via chat or email.

7. Data security

The 57aa implements appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. The main measures in place include:

• Encryption in transit: all communication between your device and 57aa's servers is encrypted with TLS 1.3 (256-bit SSL).
• Encryption at rest: sensitive data stored on our servers — such as CPF and financial information — is encrypted at rest.
• Access control: only employees with an operational need have access to personal data, and all access is logged.
• Two-factor authentication (2FA): available to all users and required for withdrawal transactions above certain amounts.
• Continuous monitoring: automated intrusion detection and suspicious activity monitoring systems operate 24 hours a day on the platform's servers.
• Security testing: 57aa periodically conducts penetration testing and security audits carried out by specialized firms.

Despite all measures taken, no system is 100% immune to incidents. In the event of a data breach that poses a risk to data subjects, 57aa will notify affected users and the ANPD within the timeframes established by the LGPD.

8. Cookies and tracking technologies

The 57aa uses cookies and similar technologies to ensure the platform runs smoothly, improve the user experience, and analyze site performance. The types of cookies used are as follows:

Essential cookies

Required for the platform's basic operation — keeping your session active after login, securing transactions, and remembering your basic language and currency preferences. These cookies cannot be disabled without affecting your use of the platform.

Performance and analytics cookies

Used to collect aggregated data on how users navigate the platform — which pages are visited most, how much time is spent in each section, and which features are used most. This data is analyzed anonymously to improve the 57aa platform.

Preference cookies

They store your platform preferences — such as favorite sports, most-visited markets, and interface settings. They improve your browsing experience by personalizing the content most relevant to you.

How to manage cookies

You can manage or disable cookies in your browser settings. Most modern browsers — Chrome, Firefox, Safari, Edge — allow you to view, block, or delete stored cookies at any time. Please note that disabling essential cookies may affect login functionality and transactions on the platform.

9. Your Rights as a Data Subject (LGPD)

The LGPD guarantees you, as the data subject whose data is processed by 57aa, a robust set of rights. All of them can be exercised free of charge, at any time, via chat or by emailing suporte@57aa.best.

All requests are responded to within 15 business days. Cases requiring additional identity verification may take up to 30 days. If you are not satisfied with the response, you may appeal to the ANPD (National Data Protection Authority).

10. Minors

The platform 57aa is intended exclusively for adults aged 18 and over. 57aa does not knowingly collect personal data from anyone under 18.

At registration, we require date of birth confirmation and perform a CPF verification to ensure the user is of legal age. If we identify that data from a minor was inadvertently collected, the account will be closed immediately, the data will be deleted, and any balance will be refunded to the original payment method.

If you are a parent or guardian of a minor and suspect they have registered on 57aa, please contact us immediately via chat or at suporte@57aa.best so we can take the necessary steps as a matter of urgency.

11. Payments and Financial Data

The 57aa offers the main payment methods available in Brazil — Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED via Nubank, Itaú, Bradesco, and Banco do Brasil. The handling of financial data follows strict security standards:

Credit and debit card data

57aa does not store full card numbers on its servers. Card payment processing is handled by PCI-DSS certified payment processors, which manage sensitive card data directly. 57aa stores only the last 4 digits and the card brand for transaction identification purposes.

Pix key and banking details

The Pix key registered for withdrawals is stored in encrypted form and used exclusively to process your withdrawal requests. 57aa does not transfer funds to any Pix key other than the one registered in the account holder's profile — this is a security measure against fraud.

Transaction history

Your full deposit and withdrawal history is available in your 57aa account and is retained for up to 5 years for legal and tax purposes. In the event of a transaction dispute, the complete history serves as the official record for resolution.

12. Updates to this Privacy Policy

The 57aa may update this Privacy Policy periodically to reflect changes in data processing practices, legal requirements, or platform features. Whenever there are material changes that affect your rights or the way your data is handled, you will be notified at least 7 days in advance by email or in-platform notice.

The date of the last update is shown at the top of this document. We recommend reviewing this policy periodically to stay informed about how 57aa handles your data.

Continued use of the platform after an updated version of this policy takes effect constitutes acceptance of the new terms. If you do not agree with the changes, you may request account closure before the effective date without prejudice to your rights regarding data already collected.

This Privacy Policy is governed by Brazilian law, in particular the LGPD (Lei nº 13.709/2018). Any dispute related to data processing by 57aa may be submitted to the ANPD (Autoridade Nacional de Proteção de Dados), in addition to our internal support channels available 24 hours a day.