F9Games Privacy Policy – LGPD Data Protection

1. Who We Are — The Data Controller

The F9Games, operator of f9games.best, is the controller responsible for processing the personal data collected in connection with the Sports Betting, online casino, poker, slots, progressive jackpot, and crash games services offered on the platform.

For the purposes of this Privacy Policy, "controller" means the entity that determines the purposes and means of processing personal data, as defined by the LGPD (Law No. 13.709/2018). Any questions, requests, or complaints related to data processing may be directed to our Data Protection Officer (DPO) at suporte@f9games.best.

2. Data We Collect

2.1 Data provided by the user

By creating an account on F9Games, you voluntarily provide:

• Full name and date of birth;
• CPF (Cadastro de Pessoa Física);
• Email address;
• Brazilian mobile phone number;
• Residential address (for identity verification);
• Identity documents (RG, CNH, or passport) requested during the KYC process;
• Pix key for withdrawal processing.

2.2 Data collected automatically

When you use the platform, we automatically collect technical information required to operate the service securely:

• IP address and approximate geolocation;
• Browser type and version, and operating system;
• Device identifier (mobile phone, tablet, or computer);
• In-platform browsing history (pages visited, session duration);
• Betting logs, transactions, and support interaction history;
• Cookie and similar technology data (detailed in section 8).

2.3 Financial transaction data

To process deposits and withdrawals in BRL, we record the payment method used (Pix, boleto bancário, credit/debit card, PicPay, or Mercado Pago), along with the amount and date of each transaction. The F9Games does not store full credit card details — this processing is handled by PCI-DSS certified payment processors.

3. How We Use Your Data

The F9Games uses the collected data for the following purposes, always within the scope disclosed at the time of collection:

• Service delivery: create and manage your account, process bets, calculate winnings, and execute withdrawals via Pix;
• Identity verification: fulfill KYC legal obligations and anti-money laundering compliance in accordance with COAF guidelines;
• Account security: detect unauthorized access, fraud attempts, and suspicious behavior;
• Customer support: identify the user when handling live chat or email support tickets;
• Transactional communications: send deposit, withdrawal, betting, and account notifications;
• Marketing communications: inform you about promotions, bonuses, and sports events — only with your consent, which can be withdrawn at any time;
• Platform improvement: analyze usage patterns to improve the experience — data is anonymized in this process wherever possible;
• Compliance with legal obligations: maintain transaction records and cooperate with competent authorities when required by law.

The F9Games does not use personal data for automated decisions with significant impact on users without the possibility of human review. In cases of automated risk analysis (such as fraud detection), users may request a review by a member of our team.

4. Legal Basis for Processing

All data processing carried out by F9Games has a legal basis under the LGPD. The main legal bases we rely on are:

• Contract performance (art. 7, V): processing required to deliver the contracted service — registration, bet processing, and payments in BRL;
• Compliance with a legal obligation (Art. 7, II): identity verification, anti-money laundering compliance, and tax records required under Brazilian law;
• Legitimate interest (Art. 7, IX): platform security, fraud prevention, and service improvement, always with appropriate safeguards in place;
• Consent (Art. 7, I): marketing communications and non-essential cookie usage — revocable at any time.

5. Data Sharing

The F9Games does not sell personal data. Sharing only occurs in the situations described below, always with appropriate safeguards:

• Payment processors: to process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago — all PCI-DSS certified;
• Identity verification providers: for the KYC process, identity document data is shared with specialized partners in compliance with the LGPD;
• Game providers: session and betting information is transmitted to game providers (Pragmatic Play, PG Soft, NetEnt, Microgaming) for round registration and auditing;
• Infrastructure services: cloud hosting, CDN, and security monitoring tools — all under Data Processing Agreements (DPAs) that ensure LGPD compliance;
• Competent authorities: when required by law, court order, or formal request from Brazilian regulatory authorities — COAF, Receita Federal, Polícia Federal.

6. Data Retention & Deletion

The F9Games retains your data for as long as necessary to fulfill the purposes for which it was collected or to meet legal obligations. General retention periods are:

• Active account data: retained for the full duration of the contractual relationship;
• Financial transaction data: a minimum of 5 (five) years after the transaction, in accordance with tax and anti-money laundering obligations;
• Betting records: minimum of 2 (two) years for auditing and dispute resolution purposes;
• Security logs: 12 (twelve) months for access logs and fraud detection data;
• Support communications: 2 (two) years after the support ticket is closed.

After account closure and once all mandatory legal retention periods have been met, your data is securely anonymized or deleted with no possibility of recovery. You may request early deletion of data not subject to legal retention obligations by emailing suporte@f9games.best.

7. Information Security

The F9Games applies robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: TLS 1.3 across all communications between the browser/app and the platform's servers;
• Encryption at rest: AES-256 for data stored in databases and backup systems;
• Access control: least-privilege principle — staff members only have access to the data required for their role;
• Multi-factor authentication: required for all administrative access to internal systems;
• Penetration testing: periodic security audits conducted by external specialists;
• Continuous monitoring: intrusion detection systems and real-time alerts for suspicious activity.

In the event of a security incident that poses a real risk to data subjects, the F9Games will notify the ANPD and affected users within the maximum timeframe required by law, with a description of the incident and the corrective measures implemented.

8. Cookies and Tracking Technologies

The F9Games uses cookies and similar technologies to ensure the platform runs correctly and to enhance your experience. The types in use are listed below:

You can manage your cookie preferences in your browser settings or in the privacy preference center of F9Games, accessible after logging in. Disabling non-essential cookies does not affect access to the platform's core features.

9. Data of Minors

The platform F9Games is strictly prohibited for anyone under 18. We do not intentionally collect personal data from minors. The registration process includes date-of-birth verification, and when necessary, we request supporting proof-of-age documentation.

If we become aware that data from a minor under 18 was inadvertently collected, we will delete that information immediately and close the associated account. Parents or guardians who identify an underage registration must contact support immediately at suporte@f9games.best.

10. International Data Transfers

Some of the technology partners of F9Games — such as cloud infrastructure providers and international game suppliers — operate servers outside Brazil. When international data transfers occur, F9Games ensures that:

• The destination country offers a level of data protection compatible with what the LGPD requires; or
• Standard contractual clauses are in place to ensure adequate protection, or;
• The data subject has given explicit consent to the transfer after being informed of the risks involved.

All international suppliers of F9Games sign Data Processing Agreements (DPAs) that include specific safeguards for cross-border transfers, aligned with LGPD standards and equivalent regulations.

11. How to Exercise Your Rights (LGPD)

To exercise any right provided under the LGPD regarding data processed by F9Games, the process is straightforward:

• Send an email to suporte@f9games.best with the subject line "LGPD Rights";
• Verify your identity using the CPF and email address registered on your account;
• Clearly describe the right you wish to exercise (access, correction, deletion, portability, etc.);
• The F9Games will confirm receipt within 48 business hours and respond to the request within 15 business days.

If there is any doubt about the requester's identity, we may ask for an additional identification document to ensure we are serving the legitimate data subject — not a third party.

12. Data Protection Officer (DPO)

The F9Games has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and the LGPD, as well as serving as the communication channel between the platform, data subjects, and the ANPD.

The DPO of F9Games can be reached by email at suporte@f9games.best — please indicate in the subject line that the message is directed to the Data Protection Officer to ensure it is routed correctly.

The DPO's responsibilities include:

• Provide internal guidance on data protection best practices;
• Receive and process requests from data subjects;
• Serve as the point of contact with the ANPD in the event of incidents or audits;
• Conduct periodic Data Protection Impact Assessments (DPIAs) for new data processing activities.

13. Changes to This Policy

The F9Games may update this Privacy Policy periodically to reflect changes in the service, Brazilian legislation, or adopted privacy practices. When significant changes are made:

• Users will be notified by email at least 10 (ten) days in advance;
• A notice will be displayed on the platform during the transition period;
• The "last updated" date at the top of this document will be revised;
• Changes that involve new data processing or a new legal basis will require explicit consent where applicable.

Continued use of the platform after the new version's effective date constitutes acceptance of the updated terms. If you do not agree with the changes, you may close your account and request deletion of your data, as described in section 6.