Privacy Policy of 27epix — Your Data Protected

The 27epix takes its users' privacy seriously — not as a legal obligation, but as a core platform value. This Privacy Policy clearly and objectively describes how 27epix collects, uses, stores, shares and protects the personal data of those who use the services available on 27epix.net, including Sports Betting, Live Casino, crash games, poker, roulette and all associated features.

This document was drafted in compliance with the General Personal Data Protection Law (LGPD — Law 13.709, of August 14, 2018), which sets out the rules on the collection, storage, processing, and sharing of personal data in Brazil. By creating an account on 27epix or use any service on the platform, you confirm that you have read, understood and agreed to the practices described in this policy.

If you have any questions about any aspect of this Privacy Policy or about how 27epix processes your data, please contact us at contato@27epix.net or via the live chat available on the platform. Our team responds in Brazilian Portuguese, 24 hours a day.

For the purposes of the LGPD, the controller of personal data collected through the platform 27epix is the company responsible for operating the 27epix.net website. The controller is the entity that makes decisions about the purposes and means of processing users' personal data.

The personal data protection officer (Data Protection Officer — DPO) of 27epix can be reached by email contato@27epix.net for privacy-related matters, the exercise of data subject rights, and clarifications about this policy. The response deadline for personal data requests is up to 15 (fifteen) business days from receipt of the complete request.

The 27epix collects personal data in the following categories, according to the purpose of each processing activity:

Data provided directly by the user at registration:

• Full name;
• CPF (Cadastro de Pessoa Física);
• Date of birth;
• Full residential address (street, number, complement, neighborhood, city, state and ZIP code);
• Email address;
• Mobile number with Brazilian area code (DDD);
• Access password (stored exclusively as a cryptographic hash — never in plain text).

Data collected during use of the platform:

• Betting history, amounts wagered, selected markets, and outcomes;
• Deposit and withdrawal history, including the method used (Pix, credit/debit card, boleto, Mercado Pago, PicPay) and amounts;
• Pix key and bank details provided for withdrawals (destination account and bank);
• Access data: IP address, device type, operating system, browser, screen resolution and session identifiers;
• Platform activity logs: pages visited, session duration, clicks and in-game interactions;
• Approximate geolocation data (derived from IP address), used for eligibility verification.

Data collected for identity verification (KYC):

• Photo ID (national ID card, driver's license, or passport);
• Proof of address issued within the last 90 days;
• Selfie with document, requested in specific cases of enhanced verification;
• Proof of source of funds documentation, for withdrawals above R$ 5,000.00.

The table below summarizes the main types of data collected and their associated purposes:

The 27epix uses personal user data solely for the purposes stated in this policy. Your data is never used for purposes inconsistent with what is described here. The main processing purposes are:

• Account operation and service delivery: create and maintain your account, process Sports Betting (football, e-sports, NBB basketball, MMA/UFC), Live Casino operations, crash games (Aviator, Spaceman, JetX, Mines), poker, roulette, and all other games available on the platform;
• Financial processing: process deposits via Pix, boleto bancário, credit/debit card, Mercado Pago, and PicPay; process withdrawals to registered bank accounts and Pix keys; maintain a record of all financial transactions;
• Identity verification and legal compliance: fulfill KYC (Know Your Customer) and anti-money laundering (AML) obligations required by Brazilian legislation applicable to the sector;
• Account security and fraud prevention: detect unauthorized access, prevent the use of multiple accounts, identify suspicious behavior, and protect the integrity of the platform;
• Customer support: answer questions, resolve technical and financial issues, and handle complaints via live chat and email;
• Platform improvement: analyze usage patterns in an aggregated and anonymized manner to identify opportunities for improving the user experience;
• Marketing communications (with consent): send offers, promotions, new game notifications and bonus information — only to users who have opted in to receive this type of communication;
• Responsible gambling: monitor behavioral patterns that may indicate problem gambling and trigger protective tools when necessary.

The 27epix does not use personal data for automated decisions that produce legal effects or significantly affect the user without the possibility of human review.

The LGPD requires that all personal data processing have a legal basis to justify it. The 27epix operates under the following legal bases, pursuant to art. 7 of Law 13.709/2018:

• Contract performance (art. 7, V): processing is necessary to provide the services contracted by the user upon account creation — without this data, it is not possible to operate the account, process bets or carry out financial transactions;
• Compliance with a legal or regulatory obligation (art. 7º, II): identity verification (KYC), anti-money laundering compliance, reporting to competent authorities, and retention of financial records are required by Brazilian law regardless of user consent;
• Legitimate interest (art. 7, IX): fraud prevention, platform security, detection of multiple accounts, and protection of other users — provided that the legitimate interests of 27epix do not override the fundamental rights of the data subject;
• Consent (art. 7, I): for marketing communications, offer personalization, and non-essential cookies — consent is collected explicitly and granularly, and may be withdrawn at any time.

The 27epix does not sell personal data of its users. Full stop. Sharing occurs only in the situations below, always limited to what is strictly necessary for each purpose:

• Payment processors: financial institutions, payment gateways, and Pix providers that process deposit and withdrawal transactions. These partners receive only the data necessary to complete the specific transaction and are contractually required to protect that information;
• Game providers: companies such as Spribe, Pragmatic Play, Evolution Gaming and SmartSoft Gaming receive anonymized or pseudonymized session identifiers to operate the games — with no access to the player's full name, CPF or financial data;
• Identity verification services (KYC): specialized partners in document verification and fraud prevention, who process user-submitted document images in a secure, certified environment;
• Infrastructure and hosting providers: cloud services and servers that store platform data, subject to data processing agreements and security obligations equivalent to those of the 27epix;
• Legal and regulatory authorities: when required by court order, determination of a competent authority (such as the Ministry of Finance or COAF), or a legal obligation applicable to the gaming sector in Brazil. The 27epix does not disclose data beyond what is specifically required;
• Analytics partners: traffic and user behavior analytics tools that operate on anonymized and aggregated data — with no individual user identification.

All third parties that access personal data of users of 27epix are subject to contractual agreements that include data protection clauses compatible with the LGPD. The 27epix requires its partners to maintain security standards equivalent to those applied internally.

The 27epix retains users' personal data for as long as necessary to fulfill the stated purposes and applicable legal obligations. The criteria used to determine retention periods are:

• Active account data: for as long as the account remains active and the user continues to use the services of 27epix;
• Financial transaction data: minimum of 5 (five) years after the transaction date, in accordance with Brazilian tax and anti-money laundering legislation currently in force;
• Identity verification data (KYC): minimum of 5 (five) years after account closure, in accordance with the sector's regulatory obligations;
• Access and activity logs: minimum of 6 (six) months, pursuant to the Brazilian Internet Civil Rights Framework (Law 12.965/2014);
• Support and communications data: 2 (two) years after the last interaction, for the purposes of record-keeping and dispute resolution;
• Marketing data (with consent): until consent is withdrawn by the user or the account is closed.

Once the applicable retention periods expire, data is securely deleted or irreversibly anonymized so that the data subject can no longer be identified.

The 27epix implements a comprehensive set of technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, or improper disclosure. The main measures in place include:

• SSL/TLS Encryption: all communication between the user's browser or app and the servers of 27epix is encrypted using TLS 1.2 or higher protocol, protecting data in transit;
• Encryption at rest: sensitive data stored on servers — including identity documents and financial information — is encrypted to industry standards;
• Two-factor authentication (2FA): available to all users and strongly recommended for additional account protection;
• Access control: user data is accessible only to employees with a justified operational need, with segregation of duties and audit logs in place;
• Continuous monitoring: intrusion detection systems and suspicious activity monitoring operate 24 hours a day to identify and respond to security incidents in real time;
• Hashed passwords: user passwords are stored exclusively as irreversible cryptographic hashes — 27epix 27epix never has access to your password in plain text;
• Periodic security testing: the platform undergoes regular penetration testing and security audits conducted by independent specialized firms.

In the event of a security incident that may affect users' personal data, 27epix will notify the affected data subjects and the National Data Protection Authority (ANPD) within the deadlines established by the LGPD, describing the nature of the incident, the data affected, and the measures taken.

The 27epix uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and — with your consent — personalize content and analyze browsing behavior.

The types of cookies used are classified as follows:

• Essential cookies (no consent required): required for the basic operation of the platform — session authentication, form security, language preferences, and bet slip state management. Without these cookies, the platform cannot function properly;
• Analytical cookies (with consent): used to understand how users interact with the platform in aggregate — most visited pages, session duration, navigation flows. Data is processed in anonymized form;
• Preference cookies (with consent): store user preferences such as default betting limits, favorite games, and interface settings;
• Marketing cookies (with consent): enable the personalization of communications and offers based on browsing behavior. Used only with the user's explicit consent.

When you access 27epix for the first time, you will be shown a cookie notice that lets you accept all, customize your preferences or decline non-essential cookies. Your cookie preferences can be updated at any time in your account settings or via the cookie banner on the site.

You can also manage cookies directly in your browser settings — Chrome, Firefox, Safari and Edge all offer options to block or delete cookies. Please note that blocking essential cookies may prevent the platform from functioning properly.

The LGPD grants you, as a personal data subject, a set of rights that 27epix commits to honoring within the timeframes and conditions established by law. See all available rights below:

The services of 27epix are intended exclusively for individuals aged 18 and over. The platform does not knowingly collect personal data from minors under 18 and does not allow minors to create accounts or use any available service.

If the 27epix become aware that personal data from a user under the age of 18 has been collected, the account will be closed immediately, the data will be deleted as soon as possible, and, where applicable, the relevant authorities will be notified.

Parents and legal guardians who believe that a minor in their care has used or attempted to use the platform should contact contato@27epix.net immediately. The team will take appropriate action without delay.

The 27epix may update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or the services offered. The date of the last update always appears at the top of this document and in the notice bar above the page header.

Material changes — such as updates to processing purposes, the types of data collected, or the legal bases used — will be communicated with a minimum advance notice of 7 (seven) days to users with active accounts, via their registered email and/or through a visible notification on the platform.

Continued use of the services of 27epix following the entry into force of changes to this policy constitutes acceptance of the new terms. If you do not agree with the changes, you may close your account before the effective date of the amendments — any available balance will be returned in accordance with standard withdrawal procedures.

For questions about this policy or any aspect of how your personal data is handled by 27epix, please contact us at contato@27epix.net or via the live chat available 24 hours a day on the platform. Our privacy team responds in Brazilian Portuguese.