55aa Privacy Policy — Your Data, Protected

1 About This Policy

The 55aa, operator of the platform available at 55aa.best, is the controller of its users' personal data for the purposes described in this document. This Privacy Policy was drafted in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018), the Banco Central do Brasil guidelines applicable to Pix transactions, and the best security practices in the digital entertainment industry.

By creating an account, depositing via Pix, placing sports bets, playing slots, live casino, crash games, or any other product available at 55aa, you provide personal data that is necessary for the service to function properly. This Policy explains, transparently and in plain language, what we do with that data — and what we definitely do not do.

This Policy applies to all users of the platform 55aa, regardless of the device used (Android phone, iPhone, or computer) or access method (Chrome, Firefox, or Safari). Please read it carefully, and if you have any questions, reach out via 24/7 chat or the privacy email listed in Section 13.

2 Data We Collect

The 55aa collects personal data in the following categories:

Registration data (provided directly by you):

• Full legal name as it appears on an official document.
• CPF (Cadastro de Pessoas Físicas).
• Date of birth.
• Email address.
• Mobile phone number.
• Full residential address (ZIP code, street, number, unit, city, state).
• Pix key registered for withdrawals (CPF, email, phone number, or random key).

Identity verification (KYC) data:

• Image of an official government-issued ID (RG or CNH) — front and back.
• Selfie holding your document for liveness verification.
• Current proof of address (issued within the last 3 months).
• In specific cases: proof of ownership of the bank account linked to Pix.

Platform usage data (collected automatically):

• IP address and approximate location (country/state/city).
• Device type, operating system, and browser used.
• Pages visited, session duration, and navigation flow within the platform.
• Betting history, deposits, withdrawals, and games played.
• Timestamps (dates and times) of logins, logouts, and actions performed on the account.

Financial transaction data:

• Amounts and dates of deposits and withdrawals made.
• Pix transaction identifiers provided by the Central Bank of Brazil.
• Partial credit/debit card data when used (only the last 4 digits are stored — full card data is handled exclusively by the certified payment processor).

3 How We Collect Your Data

Personal data at 55aa are collected through the following means:

• Registration and profile update forms — filled in directly by the user when creating an account or updating their information.
• KYC Process — submission of documents by the user via upload on the platform or through the designated support channel.
• Financial transactions — information automatically generated when you make deposits via Pix, boleto bancário, credit/debit card, PicPay, or Mercado Pago, or when you request withdrawals.
• Platform usage — data collected automatically by log and analytics systems while you browse and use the games and betting features.
• Cookies and similar technologies — detailed in Section 8 of this Policy.
• Support interactions — information provided via chat, WhatsApp, or email during customer support interactions.
• Legitimate third-party sources — in specific cases, CPF validation services with the Receita Federal to confirm the authenticity of your registered details.

4 Purposes of Data Processing

The 55aa uses the personal data collected exclusively for the following purposes:

The 55aa does not use your personal data for purposes incompatible with those listed above. Any new use requiring specific consent will be communicated before it is implemented.

5 Legal Basis for Processing (LGPD) LGPD

The LGPD requires that all personal data processing have a legal basis to justify it. At 55aa, processing activities are based on the following legal grounds set out in Article 7 of Law No. 13.709/2018:

• Contract performance (art. 7, V): most processing is necessary to fulfill the service agreement you accept when creating your account — including processing bets, deposits, and Pix withdrawals.
• Compliance with a legal obligation (art. 7, II): KYC verification, anti-money laundering monitoring, and financial record-keeping are obligations imposed by Brazilian law, including Law No. 9,613/1998 (anti-money laundering) and Banco Central do Brasil regulations.
• Legitimate interest (art. 7, IX): fraud prevention, platform security, responsible gambling monitoring, and service improvement based on aggregated usage data.
• Consent (art. 7, I): sending marketing communications and promotions — you can withdraw this consent at any time from your profile or through support.

6 Data Sharing with Third Parties

The 55aa does not sell, rent, or trade your personal data with third parties under any circumstances. Sharing occurs only in the following specific situations, all with contractual and legal safeguards:

Technical partners required for operations:

• Pix payment processors: participating financial institutions in the Pix system (Banco Central do Brasil) receive the minimum data necessary to process each transaction — in accordance with the rules of Brazil's instant payment system.
• Game providers: Pragmatic Play, NetEnt, Microgaming, Playtech, and other slots and casino providers receive an anonymous player identifier (not your name or full CPF) to record game history and manage network progressive jackpots.
• KYC verification services: specialized partners in document and identity validation receive the documents you submit solely for verification purposes — and are bound by a strict confidentiality agreement.
• Cloud and security infrastructure: hosting and monitoring providers that process data under LGPD-compliant data processing agreements.

Public authorities and legal obligations:

The 55aa may share data with Brazilian public authorities — Receita Federal, Banco Central, Ministério da Fazenda, law enforcement, or judicial authorities — when legally required by court, administrative, or regulatory order. This includes reports to COAF (Conselho de Controle de Atividades Financeiras) when suspicious transactions are identified, in accordance with anti-money laundering legislation.

7 Data Security

The 55aa implements appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or improper disclosure. Key measures include:

• Encryption in transit: all communication between your device and the platform is protected by TLS 1.3 with 256-bit SSL certificates — the same standard used by Brazilian banks and financial institutions.
• Encryption at rest: sensitive data — KYC documents, banking details, and passwords — are stored with encryption on the platform's servers.
• Access control: only employees with a verified operational need have access to users' personal data, and all access is recorded in an audit log.
• Continuous monitoring: automated systems monitor suspicious access attempts, unusual login patterns, and potential security breaches around the clock.
• Penetration testing: periodic security audits are conducted by external specialists to identify and fix vulnerabilities before they can be exploited.
• Secure authentication: passwords are stored using cryptographic hashing — the 55aa never stores your password in plain text and will never ask for it via email or chat.

What to do if you suspect a violation of your account:

If you suspect your account has been accessed without authorization — an unrecognized login, bets you didn't place, or a balance change you didn't make — contact support immediately via 24/7 chat to lock your account and start an investigation. You can change your password directly from your profile at any time.

8 Cookies and Tracking Technologies

The 55aa uses cookies and similar technologies to ensure the platform works correctly and to improve the user experience. Understanding how this works helps you know what happens when you access the site from your phone or computer.

Types of cookies used:

• Essential cookies: required for the platform's basic functionality — session authentication (keeping you logged in), bet slip, and language preferences. Without these cookies, the platform will not work properly. They cannot be disabled.
• Performance and analytics cookies: collect data on how users navigate the platform — which pages are visited most, how much time is spent in each section, and where users come from. This data is used in aggregate and anonymized form to improve the platform.
• Personalization cookies: remember preferences such as your selected language and layout settings so you don't have to reset them every time you log in.
• Security cookies: help identify suspicious behavior, protect your account from unauthorized access, and detect fraud attempts.

How to manage cookies:

You can configure your browser (Chrome, Firefox, Safari) to block or alert you about cookies. However, blocking essential cookies may prevent the platform from functioning correctly — particularly for maintaining authenticated sessions. For non-essential cookies, the privacy preference panel available in the platform footer lets you enable or disable specific categories.

9 Data Retention and Deletion

The 55aa retains your personal data for as long as necessary to fulfill the purposes stated in this Policy and to meet applicable legal obligations. General retention periods are:

• Active account data: retained for the entire period the account remains active and operational.
• Data after account closure: under Law No. 9,613/1998 (anti-money laundering) and the regulations of the Banco Central do Brasil, financial records and identification data must be retained for a minimum of 5 years after account closure.
• KYC Documents: retained for 5 years after last use for regulatory compliance purposes.
• System and security logs: retained for up to 2 years for incident investigation and dispute resolution purposes.
• Marketing data (with consent): retained until consent is withdrawn by the user.

Once mandatory retention periods have expired, data is irreversibly anonymized (making it impossible to identify the holder) or deleted from the systems of the 55aa. Anonymized data may be used for statistical and service improvement purposes without any time limit, as it no longer qualifies as personal data under the LGPD.

10 Your Rights as a Data Subject (LGPD) Your Rights

The LGPD grants you, as the data subject, the following rights regarding your personal information at 55aa:

• Confirmation and access (art. 18, I and II): confirm whether 55aa processes your data and access a copy of the information we hold about you.
• Correction (art. 18, III): request the correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion (Art. 18, IV): request that data which is unnecessary or processed in violation of the LGPD be anonymized, blocked, or deleted.
• Portability (art. 18, V): receive your data in a structured, interoperable format for transfer to another service provider.
• Erasure upon consent withdrawal (art. 18, VI): request the deletion of data processed based on your consent, subject to mandatory legal retention periods.
• Information on data sharing (Art. 18, VII): know which public and private entities 55aa has shared your data with.
• Information on non-consent (Art. 18, VIII): be informed of the consequences of not providing consent for certain types of processing.
• Withdrawal of consent (Art. 18, IX): withdraw consent previously given — especially for marketing communications.
• Review of automated decisions (art. 20): request human review of automated decisions that affect your interests, such as account blocks triggered by fraud detection systems.

How to exercise your rights:

To exercise any of the rights above, reach out through the channels below. The 55aa will respond within up to 15 business days from receipt of a complete and properly identified request:

• 24/7 Chat: within the platform, access support and let them know you wish to exercise an LGPD right.
• Privacy email: privacidade@55aa.best — for formal requests, please include your full name, CPF, and a detailed description of the right you wish to exercise.

11 Minors

The platform 55aa is intended exclusively for users aged 18 and over. We do not intentionally collect, store, or process personal data belonging to minors.

The registration process includes date-of-birth verification, and the KYC process requires submission of an official government-issued ID confirming the user is of legal age. Accounts created with false information to circumvent the age requirement are closed immediately upon detection of the irregularity, with all balances cancelled.

If you are the guardian of a minor and suspect they have created an account on 55aa using false information, contact us immediately via support chat or by emailing privacidade@55aa.best so the account can be investigated and closed. All data belonging to the minor will be deleted once the situation is confirmed, within the limits imposed by applicable legal obligations.

12 International Data Transfers

Due to the global nature of the game providers that make up the catalog of 55aa — such as Pragmatic Play, NetEnt, Microgaming, and Playtech — minimal game usage data (anonymized session identifiers) may be processed on servers outside Brazil. These transfers are carried out with the appropriate safeguards provided for under the LGPD, including:

• Standard contractual clauses requiring a level of protection equivalent to that of the LGPD.
• Data sharing restricted to the minimum necessary — session identifiers only, with no CPF, name, or banking details.
• Providers operating in jurisdictions with recognized data protection legislation or holding equivalent security certifications.

Financial data — especially data related to Pix transactions — is processed exclusively within Brazil's instant payment system, regulated by the Banco Central do Brasil, and does not leave the country.

13 Contact, DPO & Policy Changes

The 55aa has appointed a Data Protection Officer (DPO) as required by Article 41 of the LGPD. The DPO serves as the point of contact for user data privacy matters and for communications with the Autoridade Nacional de Proteção de Dados (ANPD).

Privacy contact channels:

• DPO/Privacy Email: privacidade@55aa.best
• General Email: contato@55aa.best
• 24/7 Chat: available within the platform, mentioning "LGPD request" for routing to the privacy team.

Changes to this Policy:

This Policy may be updated periodically to reflect changes in legislation, platform practices, or the services offered. Material changes are communicated via your registered email or through a prominent notice within the platform before taking effect. The most recent version will always be available at 55aa.best/privacy-policy with the last updated date shown at the top of the document.

Continued use of the platform after changes are communicated constitutes acceptance of the updated version. If you disagree with any change, you may exercise your deletion rights as described in section 10 before the new terms take effect.