Privacy Policy of Sorte26 — How Your Data Is Protected

1 Who We Are & Data Controller

The Sorte26 is a Sports Betting and digital entertainment platform, accessible at sorte26.net, designed for the Brazilian market. For LGPD purposes, sorte26 acts as the controller of personal data collected during registration and use of the platform — meaning we are the ones who determine why and how your data is processed.

Sorte26's data protection officer (DPO) can be reached by email at contato@sorte26.net with the subject line "Data Protection". This channel is dedicated exclusively to privacy-related requests and responds within 15 business days, as required by the LGPD.

2 Data We Collect

2.1 Data provided directly by you

By creating an account and using the services of Sorte26, we collect the following information:

• Registration data: full name, CPF, date of birth, email address, and mobile number;
• Address data: ZIP code, street address, city, state, and additional details, when requested for verification purposes;
• Identity documents: photo of a national ID, driver's license, or passport, and a verification selfie, collected solely as part of the KYC (Know Your Customer) process;
• Banking data: Pix key, bank branch and account number linked to the registered account, used solely for withdrawal processing;
• Support communications: full conversation history via chat, email, and any other support channel.

2.2 Automatically collected data

While you use the platform, the Sorte26 automatically collects certain technical information required for the security and proper functioning of the service:

• Access data: IP address, date and time of each session, device used (mobile, tablet, or computer), and operating system;
• Browsing data: pages visited within the platform, session duration, and features used;
• Approximate location data: derived from the IP address, used exclusively for fraud prevention and eligibility verification;
• Cookies and similar technologies: detailed in Section 6 of this Policy.

2.3 Financial transaction data

We record the complete deposit and withdrawal history for your account, including the payment method used (Pix, bank slip, credit card, debit card, PicPay, Mercado Pago, or TED transfer), along with the amount and date of each transaction. This history is retained for the legally required period and used for anti-money laundering purposes.

3 How We Use Your Data

The Sorte26 uses collected data solely for the purposes described below. No data is processed outside these purposes without prior notice and, where required, renewed consent from the User.

• Platform operation: account creation and management, processing of deposits and withdrawals via Pix and other Brazilian payment methods, bet recording, and settlement of results;
• Identity verification and compliance: CPF validation, KYC process for withdrawals, anti-money laundering, and compliance with legal requirements;
• Account security: detection of suspicious access, fraud prevention, two-factor authentication, and monitoring of irregular activity;
• Customer Support: response to requests, dispute resolution, and logging of support interactions in Brazilian Portuguese;
• Personalization: display of odds and markets relevant to the sports and games you access most, such as Brazilian football, e-sports, or live casino;
• Responsible gambling: monitoring of usage patterns to identify at-risk behavior and proactively offer responsible gaming tools;
• Communications: sending transactional emails (deposit confirmation, withdrawal status) and, if you have consented, promotional communications about Copa do Brasil, Brasileirão, special events, and bonuses.

4 Legal Basis for Processing (LGPD)

The LGPD requires that every processing of personal data have a legal basis. The Sorte26 processes your data based on the following legal grounds provided by law:

• Contract performance (art. 7, V): processing required to perform the service agreement — account operation, bet processing, and payments;
• Legal obligation (art. 7, II): identification data and financial transaction records retained for a defined period to comply with anti-money laundering obligations and tax requirements under Brazilian law;
• Legitimate interest (art. 7, IX): technical and browsing data processed for platform security, fraud prevention, and service improvement, always in a manner that does not harm the User's interests or rights;
• Consent (art. 7, I): sending promotional communications, advanced personalization, and use of non-essential cookies — with the option to withdraw consent at any time.

5 Data Sharing with Third Parties

The Sorte26 does not sell your personal data. Sharing with third parties occurs only in the situations below, always for the purpose of operating the platform securely or fulfilling legal obligations:

• Payment processors: banking and transaction data is shared with the financial institutions and payment gateways responsible for processing Pix, boleto, and card payments — such as card operators and partner banks. These partners are contractually required to handle data with the same level of security applied by sorte26;
• Identity verification providers: documents and selfies submitted during the KYC process may be handled by identity verification technology providers, who act as processors under our instructions and may not use the data for any other purpose;
• Game providers: for the operation of Live Casino and slots, minimal session information is transmitted to partner software providers solely for game control purposes;
• Authorities and public bodies: when required by law, court order, or determination of a competent Brazilian regulatory body — always limited to the minimum necessary and with notice to the User where legally permitted.

6 Cookies and Tracking Technologies

The sorte26.net website uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — personalize the content you see. The types of cookies used are:

• Essential cookies: required for the basic operation of the platform — session authentication, betting cart, and language preferences. These cannot be disabled without affecting your ability to use the service;
• Performance cookies: collect anonymous information about how users navigate the platform to help identify technical issues and improve overall performance;
• Functionality cookies: remember preferences such as platform layout and favorite sports, so you don't have to reconfigure everything on each visit;
• Analytics cookies: used with your consent to understand which sections of the platform are most visited, through analytics tools that process data in anonymized form.

You can manage or disable non-essential cookies through your browser settings or the account privacy preferences panel. Disabling essential cookies may prevent certain Sorte26 features from working properly.

7 Data Security

The Sorte26 applies strict technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. The main safeguards in place are:

• 256-bit SSL encryption across all communication between your device and the platform's servers;
• Encrypted storage of passwords and sensitive data — passwords are never stored in plain text;
• Two-factor authentication (2FA) available to all users and required for critical actions such as changing banking details;
• Strict access control internally — only sorte26 staff with a direct operational need have access to user data, and every access is recorded in an auditable log;
• Continuous monitoring of suspicious activity and automatic security alerts;
• Regular security testing conducted by our internal team and external auditors.

In the event of a security incident that may affect users' personal data, the Sorte26 commits to notifying affected data subjects and the National Data Protection Authority (ANPD) within the timeframe required by the LGPD.

8 Data Retention and Deletion

The Sorte26 retains your data for as long as necessary for each purpose, in accordance with applicable legal retention periods:

• Active account data: retained while the account is active and for up to 5 years after closure, in compliance with anti-money laundering legal obligations;
• Financial transaction data: retained for a minimum of 5 years as required by Brazilian financial legislation;
• KYC documents: retained for 5 years after account closure, or longer if required by a competent authority;
• Communication data (chat and email): retained for up to 2 years for dispute resolution and service improvement purposes;
• Non-essential cookies: expire according to each cookie's settings, generally within 12 months.

Once all legal retention periods have been met, your data is securely and irreversibly deleted from Sorte26's systems. Anonymized data may be retained indefinitely for statistical purposes, as it cannot be used to identify any individual.

9 How to Exercise Your Rights

The LGPD guarantees you a set of rights over your personal data, and Sorte26 provides a dedicated channel for exercising them. To submit any request, send an email to contato@sorte26.net with the subject line "LGPD Rights — [request type]" and include:

• Your full name and registered CPF;
• A clear description of the right you wish to exercise;
• Any additional details that may help identify the request.

The Sorte26 will respond within 15 business days, as required by the LGPD. For complex requests or those involving multiple systems, we may extend the deadline by an additional 15 business days, always notifying the User in advance.

If you feel that sorte26 has not adequately addressed your request, you have the right to file a complaint with the National Data Protection Authority (ANPD), the public authority responsible for overseeing compliance with the LGPD in Brazil.

10 Data of Minors

The Sorte26 is a platform intended exclusively for users aged 18 and over. We do not knowingly collect data from minors. If we identify that an account was created by someone under 18, the account will be closed immediately and all of that minor's data will be deleted from our systems.

If you are the legal guardian of a minor and believe they may have registered on the platform, please contact Sorte26 support by email at contato@sorte26.net immediately. We will treat the matter with the highest priority.

11 International Data Transfers

Some of the technology providers used by Sorte26 — such as cloud infrastructure providers and casino game suppliers — may be based outside Brazil. In such cases, sorte26 ensures that any international transfer of personal data takes place only when:

• The destination country offers an adequate level of data protection recognized by the ANPD; or
• The agreement with the provider includes standard contractual clauses that ensure a level of protection equivalent to that required by the LGPD; or
• Other safeguards approved by the ANPD apply to the transfer in question.

Sorte26 keeps an up-to-date record of all international transfers and can provide information about the countries involved upon request through the data channel.

12 Changes to this Privacy Policy

The Sorte26 may update this Privacy Policy periodically to reflect changes in legislation, the services offered, or data processing practices. Material changes will be communicated at least 7 days in advance through:

• An email sent to the address registered on your account;
• A visible notification on the platform upon login;
• Update of the date at the top of this page.

Continued use of the platform after changes take effect constitutes acceptance of the updated Policy. If any changes involve new consent-based data processing, we will request your explicit consent before initiating that processing.

13 Contact, DPO & Privacy Channel

For any questions regarding privacy, data protection, or the exercise of your rights under the LGPD, the Sorte26 offers the following channels:

This Policy is governed by the laws of the Federative Republic of Brazil. In the event of any conflict, the provisions of the LGPD (Law 13.709/2018) and other regulatory standards issued by the ANPD shall apply. Any disputes will be submitted to the competent jurisdiction under applicable Brazilian law.