888poker Privacy Policy — How We Protect Your Data

1. Who is the Data Controller

The controller of personal data collected through the website https://888poker.express is the platform operator 888poker, responsible for all decisions regarding the processing of information provided by users registered in Brazil.

The platform's Data Protection Officer (DPO) can be reached at privacidade@888poker.express for matters related to the exercise of your rights, complaints, or requests for information about the processing of your personal data. Response time is up to 15 business days, as established by the LGPD.

2. Data We Collect LGPD

888poker collects personal data at different points during your interaction with the platform. The categories of data collected and the contexts in which collection takes place are outlined below:

Data provided directly by the user during registration:

• Full name as shown on official ID;
• CPF (Brazilian Federal Taxpayer Registry);
• Date of birth;
• Full residential address in Brazil (postal code, street, number, city, state);
• Active email address;
• Brazilian mobile phone number;
• Pix key registered for deposits and withdrawals.

Data collected for identity verification (KYC):

• Scanned copy of national ID or driver's license (front and back);
• Selfie of the account holder holding their ID document;
• Recent proof of address required for withdrawals above R$ 5,000.00.

Financial and transaction data:

• Deposit and withdrawal history (amount, date, and method used);
• Partial credit/debit card details (the first and last four digits only — the full card number is never stored);
• Bank account details used in TED wire transfers;
• Betting history, gameplay records, and results on the platform.

Data collected automatically during platform use:

• IP address and approximate location (city/state);
• Device type, operating system, and browser used;
• Pages visited, session duration, and interface interactions;
• Cookie and similar technology data (detailed in Section 7).

3. How and Why We Use Your Data

Every piece of data collected by 888poker has a specific and legitimate purpose. We do not use personal information for purposes other than those described below without first notifying the data subject and, where required, obtaining fresh consent.

Marketing communications — such as notices about promotions, bonuses, new games, and VIP program updates — are sent only to users who have not opted out. You can unsubscribe at any time through your account dashboard under notification preferences, or via the unsubscribe link included in every email.

4. Data Sharing Important

888poker does not sell, rent, or transfer users' personal data to third parties for commercial purposes. Information is shared only in the situations listed below, each with an appropriate legal basis under the LGPD:

Service providers and data operators:

• Payment processors — companies that process transactions via Pix, boleto bancário, Visa/Mastercard cards, PicPay, and Mercado Pago receive only the minimum data necessary to process each transaction;
• Identity Verification Services (KYC) — partners specialized in document validation and fraud prevention, operating under contract with confidentiality obligations and LGPD compliance requirements;
• Hosting and security infrastructure — cloud and cybersecurity service providers that store and protect platform data;
• Customer support tools — live chat systems and ticket management tools used to assist players.

All service providers with access to users' personal data are contractually required to handle that information with the same level of protection demanded by the LGPD and this Privacy Policy. 888poker does not authorize any provider to use user data for their own purposes outside the scope of the contracted service.

Regulatory and judicial authorities:

888poker may be required to share personal data with Brazilian government authorities — such as the Receita Federal, COAF (Financial Activities Control Council), the Central Bank, the Public Prosecutor's Office, or the Judiciary — when mandated by law, regulation, or a valid court order. In such cases, we share only the minimum information necessary to fulfill the legal request.

5. Data Retention and Storage

888poker retains your personal data for as long as necessary to fulfill the purposes described in this policy, in compliance with the minimum retention periods required by law.

• Registration and account data: retained for as long as the account remains active and for up to 5 years after closure, in accordance with Brazilian financial regulatory compliance requirements;
• Identity verification documents (KYC): retained for up to 5 years after account closure, as required by anti-money laundering legislation;
• Financial transaction history: retained for up to 10 years for tax audit purposes and compliance with the Brazilian Federal Revenue Service (Receita Federal);
• Customer support records: retained for up to 2 years after the ticket is closed;
• Browsing data and cookies: retained for up to 12 months, unless the user configures a different setting.

Once retention periods expire, data is securely deleted or anonymized so that the individual can no longer be identified. You may request early deletion of your personal data through support, provided there is no legal obligation requiring the information to be retained for the full period.

6. Data Security

Protecting players' personal data is an operational priority for 888poker. The platform employs the following technical and organizational measures to ensure information security:

• SSL/TLS encryption on all communications between the user's browser or mobile device and the platform's servers;
• Encryption at rest for personal and financial data stored on our servers;
• Strict access controls: only staff with a justified operational need may access users' personal data, and all access is logged;
• Two-factor authentication available for account access;
• Continuous monitoring of suspicious activity and unauthorized access attempts;
• Regular penetration testing (pentest) and security audits conducted by independent specialized firms;
• A documented security incident response plan, including communication protocols for notifying data subjects and the ANPD.

Despite all measures in place, no digital security system provides absolute protection. Should an incident occur that may affect your data, 888poker commits to notifying you by email within the maximum timeframe established by the LGPD and to taking all necessary corrective steps to minimize the impact.

On your end, it's important to keep your password secure — don't share it with anyone, use a strong and unique combination, and enable two-factor authentication in your account dashboard. If you suspect unauthorized access, contact support immediately via live chat to have your account preventively blocked.

7. Cookies and Tracking Technologies

The 888poker website uses cookies and similar technologies to ensure the platform operates correctly, improve user experience, and collect aggregated analytics data. Below are the types of cookies used and their purposes:

Essential cookies: required for the platform's core functionality — session authentication, account security, and bet slip management. They cannot be disabled without affecting how the site works.

Performance and analytics cookies: collect aggregated, anonymous data on how users navigate the platform — most visited pages, session duration, errors encountered. This data helps improve the user experience without identifying individual players.

Functionality cookies: store user preferences such as language, interface settings, and favorite games to personalize your experience without requiring reconfiguration on every visit.

Marketing cookies: used to display promotions and relevant communications based on the player's profile within the platform. 888poker does not use third-party cookies for advertising on external sites.

You can manage your cookie preferences through your browser — most modern browsers let you block or delete cookies in their settings. Disabling non-essential cookies may affect some platform features but will not prevent basic use. To request deletion of all cookie data associated with your account, please contact support.

8. Your Rights as a Data Subject LGPD

The General Data Protection Law (LGPD) grants you, as the data subject, the following rights regarding information processed by 888poker. All of them can be exercised through the live chat support channel or by emailing privacidade@888poker.express:

• Access — request confirmation that we process your data and obtain a copy of the information we hold about you;
• Correction — request the update or correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion — request that unnecessary, excessive, or non-compliant data be anonymized, blocked, or deleted;
• Portability — receive your data in a structured, interoperable format for transfer to another service provider;
• Deletion upon consent withdrawal — where processing is based on consent, you may withdraw it at any time and request the deletion of the corresponding data;
• Information on data sharing — find out which public or private entities 888poker has shared your data with;
• Automated decision review — request human review of decisions made solely by automated systems that affect your interests;
• Objection to processing — object to data processing carried out on the basis of legitimate interest where there is a justified reason.

Requests to exercise your rights will be responded to within up to 15 business days of receipt. In complex cases requiring additional review, this deadline may be extended by a further 15 business days, with prior notice and a written justification. Exercising your rights is free of charge. In some cases, legal data retention obligations may limit our ability to fulfill a deletion request — in such situations, you will be clearly informed of the reason and the date from which deletion can be carried out.

9. Protection of Users Under 18

888poker's services are intended exclusively for individuals aged 18 and over. The platform does not intentionally collect or process personal data from minors.

Date of birth verification is required during the registration process. Accounts created by or on behalf of individuals under 18 are immediately closed upon identification, and any existing balance is returned to the legal guardian upon proof of relationship.

If you are a parent or legal guardian and suspect that a minor has accessed or created an 888poker account using your details or someone else's, please contact support immediately via live chat. 888poker takes this type of incident extremely seriously and actively cooperates with child and adolescent protection authorities.

We recommend using parental control tools on devices used at home to prevent minors from accessing betting platforms. Our support team can point you to available resources for this purpose.

10. Changes to this Privacy Policy

888poker may update this Privacy Policy periodically to reflect changes in data processing practices, updates to Brazilian legislation (including the LGPD and ANPD regulations), or modifications to the platform's services.

Material changes will be communicated at least 15 days in advance via your registered email and a prominent notice on your account dashboard. The "last updated" date at the top of this page reflects when the policy was most recently revised.

We recommend reviewing this policy periodically. Continued use of the platform after changes are published constitutes acceptance of the updated version. If you disagree with any change, you may request account closure through support before it takes effect, and your data will be handled in accordance with the policy in force at the time of closure.

11. Contact the Data Protection Officer (DPO)

To exercise your rights as a data subject, ask questions about how your data is processed, report a privacy concern, or contact 888poker's data protection officer, please use the channels below:

• DPO email: privacidade@888poker.express — for formal rights requests, complaints, and privacy matters. Response time: up to 15 business days.
• General support: contato@888poker.express — for general questions about your account, payments, and platform usage. Response time: within 12 hours.
• Live chat: available 24 hours a day, 7 days a week, in Portuguese, via the support button on the platform.

When contacting us to exercise a right under the LGPD, please include: your full name, the CPF registered on your account, a clear description of your request, and any supporting documentation if applicable. This helps us process your request faster. All communications are handled confidentially.

For privacy concerns that have not been satisfactorily resolved by 888poker, you may also file a complaint directly with the National Data Protection Authority (ANPD) through the authority's official channels.