8win Privacy Policy – Data Protection and LGPD

1. Data Controller

The controller of personal data collected through the 8win platform — available at 8win-khelo.com — is the company responsible for operating the service in Brazil. Under the LGPD, a "controller" is the legal entity that makes decisions regarding the processing of users' personal data.

To contact the 8win data controller or Data Protection Officer (DPO), please email contato@8win-khelo.com with the subject line "Privacy – LGPD". The response time for personal data requests is up to 15 business days, as established by the LGPD.

2. Data We Collect

8win collects different categories of personal data depending on how you interact with the platform. The main categories and the circumstances in which each is collected are described below.

2.1 Data You Provide Directly

• Registration data: full name, CPF, date of birth, email address, mobile number, residential address, and zip code (CEP);
• Verification documents (KYC): copy of an official government-issued photo ID (RG or CNH), proof of address, and where applicable, proof of ownership of the payment method;
• Financial data: deposit and withdrawal information, including your Pix key, bank details for wire transfers, and, for cards, the last four digits and card brand. 8win does not store your full credit or debit card number;
• Support communications: live chat conversation history and email exchanges with the 8win support team.

2.2 Automatically Collected Data

• Browsing data: IP address, browser type and version, operating system, device type (mobile, tablet, or desktop), pages visited within the platform, date and time of each access, and session duration;
• Usage data: sports betting history (Brasileirão, Copa do Brasil, Libertadores, UFC, NBB, e-sports, and others), casino game history (slots, crash games, Live Casino, progressive jackpots), amounts wagered, results, and in-platform browsing behavior;
• Cookies and similar technologies: as described in section 6 of this Policy.

2.3 Data Received from Third Parties

8win may receive data from identity verification partners, fraud analysis providers, and anti-money laundering systems. This data is used exclusively for the security and regulatory compliance purposes described in this Policy.

3. How We Use Your Data

The data collected by 8win is used for the following purposes:

• Service operation: creating and managing your account, processing deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and wire transfer, processing withdrawals, and maintaining your betting and gaming history;
• Identity verification and fraud prevention: confirming your identity, preventing the creation of multiple accounts, detecting suspicious behavior, and complying with anti-money laundering regulations (Law No. 9,613/1998);
• Customer support: answering questions, resolving complaints, and providing technical support via the platform's chat and by email;
• Communications: sending account information, transaction notifications, updates regarding changes to the Terms and Conditions or this Privacy Policy, and personalized offers where you have opted in to receive them;
• Responsible Gambling: monitoring usage patterns that may indicate at-risk behavior and activating self-control tools when necessary;
• Platform improvement: analysis of aggregated, anonymized data to understand how users interact with 8win and improve the Sports Betting, casino, and gaming experience;
• Legal and regulatory compliance: compliance with obligations required by Brazilian law, including responses to court orders and requests from competent authorities.

4. Legal Basis for Data Processing

8win processes personal data based on the following legal grounds set out in the LGPD (art. 7):

• Performance of a contract (art. 7, V): the processing is necessary to provide the sports betting and online casino services you contracted when creating an account with 8win;
• Compliance with a legal or regulatory obligation (art. 7, II): processing required by anti-money laundering regulations, identity verification, and other obligations applicable to betting platform operators in Brazil;
• Legitimate interest (art. 7, IX): for purposes such as fraud prevention, platform security, aggregated usage behavior analysis, and service improvement, always in respect of your rights and expectations as a user;
• Consent (art. 7, I): for sending marketing communications and personalized offers, based on your explicit opt-in. You may withdraw this consent at any time through your account settings panel or by email.

5. Data Sharing

8win does not sell users' personal data. Sharing only occurs in the following situations and with the categories of third parties described below:

5.1 Service Providers

Companies that assist in operating the platform have restricted access only to the data required to provide their specific services. This includes: technology infrastructure and cloud hosting providers; payment processors (Pix, cards, Mercado Pago, PicPay); identity verification (KYC) service providers; fraud analysis and security providers; and customer support platforms. All service providers are contractually required to process data in compliance with the LGPD and exclusively for the purposes authorized by 8win.

5.2 Game Providers

8win's partner game studios — including Microgaming, NetEnt, Playtech, and Pragmatic Play — may receive the minimum data necessary to run casino games, slots, crash games, and progressive jackpots. This data is limited to session identifiers and does not include payment details or personal documents.

5.3 Legal and Regulatory Authorities

8win may disclose personal data when required by law, court order, or request from competent authorities acting in the regular exercise of their functions. In such cases, disclosure is limited to what is strictly necessary and, where legally permitted, the user will be notified.

5.4 Business Transfer

In the event of a merger, acquisition, or sale of 8win assets, user data may be transferred to the new controller. In such cases, you will be notified by email before the transfer and will have the opportunity to request deletion of your data if you do not wish it to be transferred.

6. Cookies and Tracking Technologies

8win uses cookies and similar technologies to improve your experience on the platform. Cookies are small text files stored in your browser or device when you access the site.

6.1 Types of Cookies Used

• Essential cookies: required for the platform's basic operation — such as maintaining your login session, language preferences, and account security. They cannot be disabled without affecting your use of the service;
• Performance cookies: collect aggregated, anonymous information about how users navigate the platform — such as most-visited pages and errors encountered. Used to improve 8win's performance;
• Functionality cookies: remember your preferences, such as betting settings and platform display options, to personalize your experience on future visits;
• Analytics cookies: used by analytics tools to understand usage patterns in aggregate and help 8win make data-driven product decisions.

6.2 Cookie Management

You can configure your browser to block or delete cookies. Most modern browsers — Chrome, Firefox, Safari, and Edge — provide cookie control options in their privacy settings. Blocking essential cookies may prevent certain parts of the 8win platform from working correctly, including the login process and access to live betting.

7. How Long We Keep Your Data

8win retains users' personal data for as long as necessary to fulfill the purposes described in this Policy or for the period required by applicable Brazilian law.

• Active account data: retained for the full duration of the 8win account;
• Closed account data: after account closure, 8win retains identification data, financial history, and betting records for a minimum of 5 years, as required by anti-money laundering regulations and Brazilian tax obligations;
• Identity verification data (KYC): retained for a minimum of 5 years after account closure;
• Support communication records: retained for 2 years after the ticket is closed;
• Cookies and browsing data: according to the retention period configured for each cookie type, ranging from session data (deleted when the browser is closed) to up to 24 months.

Once the mandatory retention period has elapsed, data is securely deleted or anonymized in a way that makes it no longer possible to identify the individual.

8. How We Protect Your Data

8win employs appropriate technical and organizational measures to protect users' personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. These measures include:

• Encryption in transit: all communication between your device and 8win's servers uses the HTTPS protocol with an SSL/TLS certificate, ensuring that data in transit — including payment information and login credentials — cannot be intercepted;
• Encryption at rest: sensitive data stored in 8win's databases is encrypted, including identification and financial information;
• Access control: internal access to user data is restricted to the staff and systems that require it to perform their functions, based on the principle of least privilege;
• Security monitoring: 8win's systems are continuously monitored for unauthorized access attempts, attacks, and anomalous behavior;
• Authentication: 8win supports two-factor authentication for account access, reducing the risk of unauthorized access even if your password is compromised.

9. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, the following rights regarding the information processed by 8win:

• Confirmation and access (art. 18, I and II): confirm whether 8win processes your data and receive a copy of the personal information we hold about you;
• Correction (art. 18, III): request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion (art. 18, IV): request that data which is unnecessary, excessive, or processed in violation of the LGPD be anonymized, blocked, or deleted;
• Portability (art. 18, V): receive your data in a structured, machine-readable format for transfer to another controller;
• Deletion of data processed with consent (art. 18, VI): request the deletion of data processed based on your consent, such as marketing communications;
• Sharing information (art. 18, VII): receive information about which public or private entities 8win has shared your data with;
• Withdrawal of consent (art. 18, IX): withdraw consent given for specific purposes — such as receiving marketing communications — at any time and at no cost;
• Objection (art. 18, §2): object to processing carried out on the basis of legitimate interest where it causes a disproportionate impact on your rights.

To exercise any of these rights, submit a request to contato@8win-khelo.com with the subject line "LGPD Request – [request type]". 8win will respond within up to 15 calendar days. In some cases, identity verification may be required before processing the request, to ensure data is provided only to the legitimate account holder.

10. Minors

8win's services are intended exclusively for users aged 18 and over. 8win does not knowingly collect personal data from anyone under 18. If we identify that an account was created by a minor, the account will be immediately closed, the data will be deleted, and any deposited balance will be returned to the original payment method after verification.

If you believe a minor under 18 has created an account on 8win, please contact us immediately via the support chat or by email at contato@8win-khelo.com so we can take the necessary action.

11. International Data Transfers

Some of the service providers used by 8win — such as cloud infrastructure platforms and casino game providers — may be located outside Brazil. When personal data of Brazilian users is transferred to other countries, 8win ensures the transfer takes place with appropriate safeguards, as required by art. 33 of the LGPD. This includes:

• Transfer to countries with an adequate level of data protection, as recognized by the National Data Protection Authority (ANPD);
• Use of standard contractual clauses requiring the recipient to handle data with a level of protection equivalent to that required by the LGPD;
• Transfers required for the performance of the service agreement, such as processing rounds in casino games hosted by international providers.

You can request more information about international data transfers made by 8win by emailing contato@8win-khelo.com.

12. Changes to this Privacy Policy

8win may update this Privacy Policy periodically to reflect changes in its services, applicable legislation, or data processing practices. Material changes will be communicated by email and through an in-platform notification at least 7 days before the new terms take effect.

The date of the most recent update is always shown at the top of this page. We recommend reviewing this Policy periodically. Continued use of the platform after changes are published constitutes acceptance of the updated terms. If you disagree with any change, you may close your account and request deletion of your data.

13. Contact & Data Protection Officer (DPO)

8win has appointed a Data Protection Officer (DPO) responsible for receiving and responding to communications from data subjects and for liaising with the National Data Protection Authority (ANPD).

To contact the DPO or for any questions regarding the processing of your personal data by 8win:

• Email: contato@8win-khelo.com (subject: "Privacy – LGPD")
• Live chat: available 24/7 directly on the platform, in Portuguese

The response time for LGPD-related requests is up to 15 calendar days from receipt. If you are not satisfied with 8win's response, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), the federal body responsible for enforcing LGPD compliance in Brazil.