Privacy Policy R7Bat: your data protected by the LGPD

This Privacy Policy describes how r7bat — a Sports Betting and online casino platform built for Brazilian players — collects, uses, stores, shares, and protects its users' personal data in strict compliance with the General Personal Data Protection Law (LGPD — Law No. 13,709/2018).

By creating an account or accessing or using any r7bat service — including betting on Brasileirão Série A, Copa do Brasil, Libertadores, slots, live casino, crash games, poker, or roulette — you confirm that you have read and understood this Policy and consent to the data processing described herein.

This Policy applies to all r7bat access channels: website, mobile browser, and the official app for Android and iOS. It may be updated periodically — the version published on this page is always the current one, with the last updated date shown at the top.

R7bat collects personal data only when there is a clear and legitimate purpose for doing so. The categories of data we process include:

R7bat does not collect sensitive data such as racial origin, political opinion, health data or biometrics — unless biometrics are voluntarily provided by the user as an additional account authentication method.

Personal data collected by r7bat is used exclusively for the following purposes, each with a legal basis under the LGPD:

• Account management: create, maintain, and close your account; handle authentication; restore access;
• Payment processing: process deposits via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED through Nubank, Itaú, Bradesco, and Banco do Brasil; process withdrawals to the account holder's bank account;
• Fraud prevention and security: verify user identity (KYC), detect unauthorized access, identify suspicious behavioral patterns, and fulfill legal anti-money laundering obligations (Law No. 9,613/1998);
• Compliance with legal obligations: comply with requests from regulatory and judicial authorities as required by applicable Brazilian law;
• Customer support: answer questions, resolve account issues, and process requests related to bonuses, withdrawals, and promotions;
• Responsible gambling: monitor gameplay patterns to identify behaviors that may indicate problem gambling and offer preventive tools (deposit limits, self-exclusion);
• Marketing communications: sending r7bat offers, promotions, and updates — only to users who have explicitly consented to this type of communication. You can opt out at any time through your account dashboard or by contacting support.

R7bat does not use your personal data for automated decisions that produce significant effects on you without the possibility of human review — such as withdrawal rejections or account blocks based solely on algorithms, without review by a staff member.

R7bat does not sell, rent, or transfer your personal data to third parties for commercial purposes. Data is shared only in the following situations, all of which are necessary for the platform to operate:

• Payment providers: card gateways, financial institutions and digital wallets (PicPay, Mercado Pago) receive only the data strictly necessary to process the specific transaction;
• Game providers: Pragmatic Play, PG Soft, Evolution, Play'n GO, and other providers integrated with r7bat receive an anonymous session identifier — not your CPF or full identity data — to process bets and game results;
• Security and anti-fraud services: specialized identity verification (KYC) and fraud detection companies may receive registration data for verification purposes, under contracts with mandatory confidentiality and LGPD-equivalent protection clauses;
• Legal authorities: r7bat may disclose personal data when required by law, court order, or legitimate request from competent Brazilian authorities (such as COAF — Financial Activities Control Council);
• IT infrastructure: servers, hosting services, and CDN providers used by r7bat may process personal data as part of the platform's technical operation, under data processing agreements that ensure confidentiality and security.

R7bat retains your personal data for as long as necessary to fulfill the purposes described in this Policy, in accordance with mandatory legal retention periods:

• Registration and identity data: retained for the period the account remains active and for up to 5 years after closure, in compliance with legal anti-money laundering obligations;
• Financial transaction history: retained for up to 5 years after the transaction, as required by Brazilian tax and financial legislation;
• Browsing and behavioral data: retained for up to 2 years after the last access, used for security, fraud analysis, and platform improvement;
• Support conversations: retained for up to 3 years for reference in disputes or complaints;
• Marketing data (consent-based): retained until consent is withdrawn by the user.

Once the applicable retention periods have elapsed, data is securely deleted or anonymized — meaning it can no longer be linked to you individually. Irreversible anonymization is not subject to LGPD deletion rules, as the data is no longer considered personal.

R7bat uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and measure service performance. The cookies used fall into the following categories:

• Essential cookies: required for the platform's core functionality — authentication, session management, security and fraud prevention. They cannot be disabled without compromising account access;
• Performance cookies: collect anonymous information about how users navigate r7bat — most visited pages, session duration, errors encountered — to improve the overall platform experience;
• Personalization cookies: remember preferences such as language, favorite game and interface settings to personalize your experience without requiring reconfiguration on every visit;
• Marketing cookies: used only with your explicit consent, to display relevant r7bat communications based on your platform usage history. You can manage or disable these cookies through your account settings panel or your browser settings.

R7bat does not use third-party cookies to track your behavior outside the platform or to build user profiles for resale to external advertisers.

The LGPD grants you, as the owner of your personal data, a set of rights that r7bat is fully committed to upholding. Below are all your rights and how to exercise them:

R7bat applies technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or destruction. Key protections currently in place include:

• Encryption in transit: all communications between your device and r7bat's servers are protected by 256-bit TLS/SSL encryption;
• Encryption at rest: sensitive data stored on our servers — including Pix keys and identity documents — is encrypted at rest;
• Access control: internal access to user data is restricted to the minimum necessary (principle of least privilege) and protected by multi-factor authentication for all staff with access to production systems;
• Continuous monitoring: automated systems and our security team monitor access, transactions, and anomalous behavior in real time, 24 hours a day;
• Security testing: r7bat conducts regular penetration tests and vulnerability assessments on its systems to identify and address security gaps before they can be exploited;
• Secure backups: data backups are stored in encrypted form at locations geographically separate from the primary server.

R7bat is a platform exclusively for users aged 18 and over. We do not knowingly collect, process, or store personal data from anyone under 18.

By creating an account, the user expressly confirms they are 18 years of age or older. Should we become aware that data from a minor was inadvertently collected, we will delete that information immediately and permanently, and close the corresponding account.

If you are a parent or legal guardian and believe a minor has created an account on r7bat, please contact our support team via live chat or at contato@r7bat.com so we can take the necessary steps as quickly as possible.

R7bat may update this Privacy Policy periodically to reflect changes in Brazilian law — particularly the LGPD and ANPD regulations — as well as in our operational practices or the services offered by the platform.

When changes are significant, r7bat will notify users via their registered email or through an in-platform notice before the changes take effect. The "last updated" date at the top of this page shows when the current version was published.

Continued use of r7bat after updates are published constitutes acceptance of the revised Policy. If you disagree with the changes, you may close your account through support — any pending real-money balances will be processed as normal, and your data will be retained only for the minimum period required by law following closure.

For any questions, requests or complaints regarding the processing of your personal data by r7bat, please contact our Data Protection Officer (DPO) through the channels below:

• Email: contato@r7bat.com — responses within 2 business days;
• Live chat: available 24/7, directly on the platform — average response time under 2 minutes;
• WhatsApp: available 24/7 for urgent account and privacy matters.

All requests relating to the exercise of data subject rights (access, correction, deletion, portability) are processed within 15 business days after confirmation of receipt and verification of the requester's identity.

If you prefer to contact the regulatory authority directly, you can file complaints about personal data handling with the National Data Protection Authority (ANPD), through the official channels available on the ANPD website.

When you play on r7bat — whether betting on a Brasileirão Série A match, spinning a slot in the casino, playing Aviator, or sitting at a live baccarat table — the platform needs certain information to operate. But "needing information to operate" is not the same as "collecting everything possible." That distinction is at the heart of our approach to privacy.

To create your account, r7bat needs to know who you are — your name, CPF and date of birth. This is required for two reasons: to confirm you are 18 or older, and to ensure that the account holder is the same person who will manage the balance. When you make a deposit via Pix, we need to process the associated Pix key — and when you request a withdrawal, the funds go exclusively to the bank account linked to your CPF. This financial data is handled with encryption and is never stored in plain text on our servers.

Browsing data — such as your IP address, device type, and the games you access — is used primarily for security purposes. Functions like flagging a login from an unfamiliar IP, detecting patterns that suggest fraud, or confirming that a bet genuinely came from your account all rely on this information. We do not use browsing data to build user profiles for resale to advertisers.

In the context of responsible gambling, r7bat may monitor behavioral patterns — deposit frequency, session length, sudden changes in betting volume — to identify signs that gambling may be shifting from entertainment to a problem. This monitoring is not invasive: it does not involve analyzing the content of private conversations or tracking activity outside the platform. It is an internal tool used exclusively to uphold our responsible gambling policy and offer support before a problem escalates.

Every data processing activity at r7bat has a clear legal basis under the LGPD — specifically the grounds set out in Article 7: contract performance (operating your account and processing payments), legal obligation (KYC, anti-money laundering compliance), legitimate interest (security and fraud prevention), and consent (marketing communications, non-essential cookies). Each legal basis carries its own data retention and deletion rules, which are detailed in Section 5 of this Policy.

The LGPD came into effect in Brazil in September 2020 and represented a significant shift in how companies are required to handle personal data. r7bat has adapted its processes, supplier contracts and internal systems to fully comply with the law's requirements — not merely because it is mandatory, but because we believe that respecting user privacy is a core part of the trust we want to build with everyone who chooses our platform.

If you have any questions about what we do with your data — it doesn't have to be a formal data subject request, a simple question is fine — our Portuguese-speaking team is available 24 hours a day via live chat, WhatsApp, and email. Privacy shouldn't be an inaccessible topic, and r7bat wants you to feel comfortable asking.