Xx88 Privacy Policy — Your Data Treated with Respect

When you create an account at xx88, make a deposit via Pix, bet on a live Brasileirão match, or play at a live roulette table, you share information with us. It's natural to want to know what we do with it — and that's exactly what this Privacy Policy explains.

Xx88 was built for the Brazilian bettor, and that includes respecting the Lei Geral de Proteção de Dados (LGPD — Law 13.709/2018), the Brazilian legislation that governs how companies may collect and process personal data of Brazilian citizens. We do not treat privacy as a formality: it is a core part of our commitment to being a trustworthy platform for regular bettors.

This policy applies to all xx88 users residing in Brazil, regardless of the device used — mobile, tablet, or computer. By using any service on the platform after this version is published, you confirm that you have read and understood these terms.

Xx88 collects personal data in three ways: information you provide directly, information generated automatically through your use of the platform, and information from third parties (such as payment processors). The main types of data processed are outlined below:

Data you provide

• Registration: Full name, CPF, date of birth, email address, phone number, residential address, and account password.
• Identity verification (KYC): A government-issued photo ID (RG, CNH, or passport), proof of address, and proof of the payment method used.
• Payments: Pix key, credit or debit card details (tokenized by the payment processor — xx88 does not store the full card number), and PicPay, Mercado Pago, or bank account details for TED transfers.
• Communications: Messages sent to support via live chat, email, or VIP WhatsApp, including content and history.

Automatically collected data

• Usage data: Betting history (markets, amounts, timestamps), casino games accessed, freebets used, and VIP Program progression.
• Technical data: IP address, browser type and version, operating system, device identifier (phone, tablet, or computer), approximate location via IP.
• Cookies and similar technologies: Detailed in Section 6 of this policy.

Xx88 uses your personal data solely for the purposes listed below. Each purpose has a corresponding legal basis, described in Section 4 of this policy. We never use your data for purposes other than those stated here without first obtaining your authorization or updating this policy.

If you opted in to marketing communications from xx88 at registration, you can withdraw that preference at any time in your account settings or by clicking "unsubscribe" at the bottom of any promotional email. Opting out of marketing does not affect operational communications about your account.

The LGPD requires every company that processes personal data in Brazil to declare the legal basis authorizing each processing activity. xx88 relies on the following legal bases set out in Art. 7 and Art. 11 of Law 13.709/2018:

• Contract performance (Art. 7º, V): Most data processing at xx88 takes place because it is necessary to provide the service you signed up for — processing Pix deposits, recording bets, calculating and paying out withdrawals, crediting bonuses, and managing the VIP Program.
• Legal obligation (Art. 7, II): Identity verification (KYC), transaction monitoring for anti-money laundering compliance (Lei 9.613/1998), and minimum record retention are legal obligations that apply regardless of your consent.
• Legitimate interest (Art. 7, IX): Used for fraud prevention, platform improvement, and user security, always with minimal impact on your rights and proportionate to the purpose.
• Consent (Art. 7, I): For marketing communications and promotions only. You can withdraw this consent at any time without affecting any other services on the platform.

Xx88 does not sell, rent, or trade users' personal data to third parties for commercial purposes. Data sharing occurs only in the cases below, all of which are necessary for service delivery or compliance with legal obligations:

• Payment processors: Data required to process deposits and withdrawals via Pix, PicPay, Mercado Pago, credit/debit card, boleto bancário, and TED transfers to banks such as Nubank, Itaú, Bradesco, and Banco do Brasil. These partners are contractually required to protect your data.
• Casino game providers: For live casino games (roulette, blackjack, baccarat) and slots, minimal technical data (session identifier, available balance) is shared with the certified providers that operate the tables. No identifiable personal data is shared beyond what is strictly necessary.
• Identity verification services (KYC): For document validation during the verification process, data may be processed by specialized KYC partners under a confidentiality agreement.
• Technology infrastructure providers: Cloud servers, transactional email platforms, and security analytics tools, all operating under data processing agreements compatible with the LGPD.
• Public authorities: When required by law, court order, or applicable regulation — such as the Financial Activities Control Council (COAF) for anti-money laundering obligations. In such cases, xx88 is legally required to provide the requested information.

Xx88 uses cookies and similar technologies to ensure the platform runs correctly, improve your experience, and keep your session securely active. Cookies are small text files stored on your phone or computer by your browser.

Types of cookies used

• Essential cookies: Required for the platform's basic functionality — keeping your session active after login, processing bets, and loading your account balance. They cannot be disabled without affecting your ability to use the site.
• Performance cookies: These collect anonymous data on how users navigate the platform — which pages are visited most, where errors occur — to improve the overall experience. They do not identify users individually.
• Functional cookies: They remember user preferences such as language, odds display format (decimal or fractional), and notification settings.
• Security cookies: Used to detect suspicious activity, multiple simultaneous logins, and unauthorized access attempts, keeping your account protected from fraud.

You can manage cookie preferences in your browser settings. Disabling essential cookies may prevent the platform from functioning properly. For non-essential cookies, you may opt out without losing core functionality.

Xx88 retains your personal data for as long as necessary to fulfill the purposes stated in this policy or to meet legal obligations. The general retention periods are:

Once retention periods expire, data is securely deleted or anonymized in a way that makes it impossible to re-identify the subject. Anonymization follows technical standards that make individual identification irreversible.

Xx88 applies appropriate technical and administrative measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. Privacy is not just a policy — it is a practice built into every layer of the platform's development and operation.

• Encryption in transit: All traffic between your browser or app and xx88's servers is encrypted with 256-bit SSL/TLS — the same technology used by Itaú, Nubank, and Banco do Brasil to secure banking transactions.
• Encryption at rest: Sensitive data stored on our servers — including passwords (bcrypt-hashed) and financial data — is encrypted even when not in use.
• Access control: Only employees with a legitimate need and proper authorization have access to personal data. Access is recorded in auditable logs and reviewed on a regular basis.
• Two-factor authentication (2FA): Available and recommended for all xx88 users. Once 2FA is enabled, every account login requires an additional confirmation via your phone, on top of your password.
• Security monitoring: Automated systems monitor the platform around the clock for suspicious access, brute-force attempts, and anomalous behavior patterns.
• Penetration testing: Periodic security audits conducted by independent specialists to identify and remediate vulnerabilities before they can be exploited.

In the event of a security incident that poses a real risk to data subjects, xx88 will notify affected users and the National Data Protection Authority (ANPD) within the timeframes set by the LGPD, providing clear information about what happened, the data involved, and the measures taken.

The LGPD grants you, as a data subject, a set of rights that xx88 is required to respect and uphold. Below you will find what you can request and how to exercise each right:

To exercise any of these rights, send an email to suporte@xx88-vip.net with the subject line "LGPD — [Right Name]" and your CPF. xx88 will process your request within 15 calendar days, in accordance with the statutory deadline.

Xx88 services are intended exclusively for users aged 18 and over. The platform does not intentionally collect, process, or store personal data from minors.

During registration, the user declares they are at least 18 years old. This declaration is verified through the mandatory KYC process before the first withdrawal. If xx88 determines that an account belongs to a minor — whether through document verification or a report — the account will be immediately closed, all data will be deleted, and any winnings will be canceled.

If you are the parent or guardian of a child or teenager and believe they have created an account on xx88, please contact us immediately at suporte@xx88-vip.net with the subject line "Minor's Account — Urgent". We will investigate and act with the highest priority.

Xx88 has appointed a Data Protection Officer (DPO) as required by Art. 41 of the LGPD for companies that process personal data at scale. The DPO is the official point of contact for all privacy and personal data protection matters.

Contact channels for privacy matters

• DPO Email: suporte@xx88-vip.net — Use the subject line "LGPD" for priority handling. Privacy-related requests are responded to within 5 business days.
• Live chat: Available 24/7 on the platform. For non-urgent general account and privacy questions.
• VIP WhatsApp: For Gold and Diamond tier members, via a dedicated account manager, for matters involving account data.

Updates to this policy

Xx88 may update this Privacy Policy periodically to reflect changes in legislation, the services offered, or internal data processing practices. For changes that materially affect your rights, xx88 will notify users by email at least 10 days before the new version takes effect.

The "Last updated" date shown at the top of this document reflects when the current version was published. We encourage you to review this policy periodically. Continued use of the platform after a new version is published will be considered acceptance of the changes.