55as Privacy Policy – LGPD Data Protection

1. Data Controller

The controller of personal data collected by the 55as platform — responsible for decisions about how and why your data is processed — is the operating company of the 55as platform, available at https://55as.net.

Data Protection Officer (DPO) contact channel: contato@55as.net. For matters specifically related to data protection and exercising your LGPD rights, use the subject line "LGPD – [Request Type]" in your email to help us route your request faster.

This Privacy Policy applies to all registered users of the 55as platform who are residents of Brazil, regardless of the device they use to access it — desktop, mobile, or tablet.

2. Data We Collect

55as collects only the data necessary to operate the player's account, process financial transactions in BRL, and comply with legal and regulatory obligations. Below are the categories of data collected and their respective sources.

2.1 Data you provide directly:

• Identification data: full name, CPF, date of birth, gender, and nationality — collected at registration and required for identity verification (KYC).
• Contact details: email address, mobile number, and full residential address (street, city, state, and ZIP code).
• Financial data: Pix key details (CPF, email, phone number, or random key), information required for boleto processing, and credit/debit card details (only the minimum data necessary for processing — full card data is processed directly by PCI-DSS certified gateways and is not stored on 55as servers).
• Identity documents: a copy of a government-issued ID and proof of address, requested during the KYC verification process prior to your first withdrawal.

2.2 Automatically collected data:

• Platform usage data: betting history (sports, markets, amounts, and outcomes), casino session history, time spent on the platform, and access frequency.
• Technical data: IP address, browser type and version, device operating system, device identifier (for the mobile app), and approximate geolocation based on IP.
• Cookie data: information stored by session and persistent cookies as described in Section 5 of this Policy.

3. Purpose of Data Processing

55as processes your personal data based on legitimate and transparent purposes. Each category of data collected has a specific purpose and a corresponding legal basis under the LGPD.

3.1 Account operation and service delivery: identification and contact data are used to create and manage your account, authenticate your access, process Sports Betting on the Brasileirão and other competitions, enable casino games, and manage your available balance. Legal basis: performance of a contract (art. 7, V, LGPD).

3.2 Financial transaction processing: financial data (Pix key, banking information) is used exclusively to process deposits and withdrawals in BRL via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfer. Legal basis: performance of a contract and compliance with a legal obligation (art. 7, II and V, LGPD).

3.3 Identity verification (KYC) and fraud prevention: identity documents and CPF are used to verify that the account holder is at least 18 years old, that each CPF has only one active account, and that withdrawals are processed only to accounts matching the holder's CPF. They are also used to monitor suspicious activity related to fraud, money laundering, and bonus abuse. Legal basis: compliance with a legal obligation and legitimate interest (Art. 7, II and IX, LGPD).

3.4 Account-related communications: email and phone number are used to send transaction notifications (deposit confirmations, withdrawal processing updates), security alerts (suspicious login attempts), communications about changes to the Terms and Conditions, and notifications about 55as promotions you have opted into. Legal basis: contract performance and consent (Art. 7, I and V, LGPD).

3.5 Platform improvement: usage behavior data (betting history, access patterns) is analyzed in aggregate and anonymized form to identify product improvements, optimize the mobile experience, and enhance odds offerings for the Brasileirão and other markets. Legal basis: legitimate interest (art. 7, IX, LGPD).

3.6 Responsible gambling: usage behavior data is analyzed to identify patterns that may indicate problem gambling — such as very long sessions or frequent deposits in increasing amounts — and to trigger the responsible gambling tools available on the platform. Legal basis: legitimate interest and protection of life and health (Art. 7, VII and IX, LGPD).

4. Data Sharing

55as does not sell, rent, or transfer your personal data to third parties for commercial or advertising purposes. Full stop. Data sharing occurs only in the situations listed below, strictly necessary for the platform to operate.

4.1 Payment service providers: information required to process financial transactions is shared with the payment gateways responsible for handling Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago. These providers act as data processors under confidentiality agreements and may only use the data for payment processing purposes.

4.2 Game providers: to enable casino games to function, the minimum necessary data (such as an anonymized account identifier and available betting balance) is shared with providers such as Pragmatic Play, Evolution Gaming, and NetEnt. These providers do not receive personally identifying data such as CPF or full name.

4.3 Legal and regulatory obligations: data may be shared with Brazilian public authorities — such as the Banco Central do Brasil, the Receita Federal, or law enforcement — when required by a legal order, court decision, or legitimate administrative process. 55as verifies the legality of each request before sharing any data.

4.4 Technical infrastructure providers: hosting servers, CDN (Content Delivery Network) services, and security monitoring providers have technical access to the infrastructure where data is stored, but operate under strict confidentiality agreements and are not permitted to access individual user data.

5. Cookies and Tracking Technologies

55as uses cookies and similar technologies to ensure the platform functions properly, authenticate login sessions, and understand how players use the available features. No cookies are used to track your activity outside the 55as platform.

5.1 Essential cookies: required for the platform's core functionality — account authentication, active session maintenance, language preferences, and security. These cannot be disabled without compromising platform performance. Legal basis: contract execution.

5.2 Performance cookies: collect information on how you use the platform — which pages you visit most often, loading times for each section, and any technical errors encountered. This data is used in aggregate to improve the overall experience. These cookies can be disabled in the platform's cookie settings.

5.3 Functionality cookies: store user preferences such as favorite sports, odds format settings (decimal or fractional), and notification preferences. They allow the platform experience to be personalized. They can be disabled, but doing so may affect some personalized features.

5.4 Cookie management: you can manage your cookie preferences directly in your browser settings or through the cookie preferences panel available on the 55as platform. Disabling essential cookies may prevent access to your account.

• Essential cookies: always active — required for login and session security.
• Performance cookies: can be disabled — they collect usage data anonymously.
• Functionality cookies: can be disabled — store personal preferences.

6. Data Security

55as applies multiple layers of technical and organizational security to protect your personal data against unauthorized access, loss, destruction, or improper disclosure.

6.1 Encryption in transit: all communications between your device and the 55as platform are encrypted using TLS 1.3 / 256-bit SSL. This means that data in transit — including login credentials, payment information, and personal data — cannot be read even if intercepted.

6.2 Encryption at rest: sensitive data stored on 55as servers — such as passwords (stored as hashes using the bcrypt algorithm) and financial information — is encrypted at rest using current security standards.

6.3 Access control: access to players' personal data is restricted to only those staff members and systems that need it to perform their functions. Multi-factor authentication (MFA) is mandatory for all administrative access to 55as systems.

6.4 Monitoring and threat detection: automated systems monitor the platform 24 hours a day for suspicious activity — unauthorized access attempts, anomalous traffic patterns, and potential fraud attempts. Alerts are immediately escalated to the security team.

6.5 PCI-DSS for card data: 55as does not store full credit or debit card details on its servers. All card transactions are processed entirely by PCI-DSS Level 1 certified payment gateways — the highest security standard for card payment processing.

6.6 Incident response: in the event of a data breach that may affect the rights of data subjects, 55as will follow the mandatory notification procedure to the National Data Protection Authority (ANPD) within the legal timeframe and will inform affected users with clear details about what occurred and the measures taken.

7. Data Retention

55as retains your personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal and regulatory obligations in Brazil.

7.1 Active account data: while your account is active, your registration data, transaction history, and betting history are retained to operate the contracted services.

7.2 After account closure: after voluntary account closure, 55as retains data for the minimum period required by law:

• Financial records (deposits, withdrawals, transaction history): minimum of 5 years, in accordance with Brazilian tax and financial regulatory obligations.
• KYC data (identity documents): minimum of 5 years after account closure, in accordance with anti-money laundering regulations (Law No. 9.613/1998).
• Support communication history: 2 years after the last contact.
• Technical log data (IPs, access logs): 6 months, unless required for an ongoing fraud investigation.

7.3 After the retention period: once the minimum legal retention period has elapsed, data is securely deleted or anonymized so that the individual can no longer be identified. Anonymization permanently removes any link between the data and the user's identity.

8. Your Rights as a Data Subject (LGPD)

The Lei Geral de Proteção de Dados (LGPD) grants you, as a data subject, a set of rights that 55as is committed to respecting and facilitating. See each right below and how to exercise it.

9. Minors

The 55as platform is strictly intended for users aged 18 and over. 55as does not intentionally collect personal data from anyone under 18. Any person under 18 is prohibited from using the platform, creating an account, or placing any type of bet.

If 55as determines — through the KYC identity verification process or by any other means — that a user is under 18 years of age, the account will be immediately closed, access to the platform will be blocked, and all collected personal data will be deleted as soon as technically possible, subject to mandatory legal retention requirements.

If you suspect that a minor has created an account on 55as, please contact us immediately at contato@55as.net or via live chat so the situation can be investigated and resolved promptly.

10. Changes to this Privacy Policy

55as may update this Privacy Policy periodically to reflect changes in data processing practices, amendments to Brazilian legislation — including ANPD regulations — or platform improvements.

10.1 Change notification: when we make material changes to this Policy — ones that significantly affect how your data is processed or that expand the purposes of use — you will be notified by email at least 15 days before the changes take effect. Minor updates (wording corrections, clarity adjustments with no practical impact) may be made without prior notice.

10.2 Current version: the most recent version of this Policy will always be available on the 55as platform at https://55as.net/privacy-policy, with the date of the last update indicated at the top of the document.

10.3 Acceptance of changes: continued use of the 55as platform after an updated version takes effect constitutes acceptance of the new Policy. If you do not agree with the changes, you may close your account before the new terms come into effect, as described in the Terms and Conditions.