26a27 Privacy Policy – Protection of Your Data

1. Data Controller

A 26a27, operator of the platform available at 26a27.net, is the controller of personal data collected from its users in Brazil, as defined by the General Personal Data Protection Law (Lei nº 13.709/2018 — LGPD). This means 26a27 is responsible for determining the purposes and means of processing the data you provide when registering and using our services.

For matters related to personal data, you can reach our Data Protection Officer (DPO) at privacidade@26a27.net. The 26a27 DPO is responsible for ensuring that data processing complies with the LGPD and for responding to data subject requests within the legally required timeframe.

2. Data We Collect

26a27 collects personal data in the following categories, based on what each stage of the user relationship requires:

2.1 Data provided directly by you

• Registration data: full name, CPF, date of birth, email address, and phone number.
• Address data: street address, number, unit, neighborhood, city, state, and ZIP code, requested for proof of residence in Brazil.
• Identity documents: RG, CNH, or passport, collected during the identity verification (KYC) process when required.
• Financial data: information about the payment methods used, such as Pix keys, partial card details (last four digits and card brand only), and banks linked to the account — Nubank, Itaú, Bradesco, Banco do Brasil, Caixa, and others.
• Communications: chat history with 26a27 support, including live chat and emails.

2.2 Data collected automatically during use

• Access data: IP address, browser type, operating system, device (phone, tablet, or computer), and language settings.
• Usage data: pages visited, sections accessed, session duration, bets placed, games accessed, and login times on the 26a27 platform.
• Geolocation data: approximate location based on IP address, used exclusively for geographic eligibility verification.
• Cookies and identifiers: as described in section 8 of this policy.

3. Purposes of Processing

The personal data collected by 26a27 is used for the following purposes:

4. Legal Bases (LGPD)

All data processing carried out by 26a27 is grounded in at least one of the legal bases set out in Article 7 of the LGPD:

• Contract performance (Art. 7º, V): processing necessary to deliver the service contracted by the user upon registering on the platform — bet processing, Pix payments, and live casino operation.
• Compliance with a legal obligation (Art. 7º, II): processing required by applicable Brazilian laws and regulations, including customer identification obligations (KYC), anti-money laundering requirements, and tax obligations.
• Legitimate interest (Art. 7º, IX): fraud prevention, platform security, and responsible gambling monitoring — processes that protect both 26a27 and users alike.
• Consent (Art. 7º, I): for marketing communications and content personalization beyond essential service communications. You can withdraw this consent at any time from your account dashboard.

5. Data Sharing

26a27 does not sell personal data to third parties. Sharing is limited to the following categories of recipients, all bound by contractual obligations of confidentiality and data protection:

5.1 Operational service providers

Companies that directly support the operation of the platform, including payment processors (responsible for processing Pix, boleto bancário, cards, and digital wallets such as PicPay and Mercado Pago), live game providers (Evolution Gaming, Pragmatic Play Live, and others), identity verification services, and IT infrastructure providers. These partners only have access to the minimum data necessary to perform their functions.

5.2 Competent authorities

26a27 may share data with Brazilian regulatory, law enforcement, judicial, or tax authorities when required by law, court order, or official investigation. In such cases, sharing is limited to exactly what was requested and, wherever legally permitted, the user is notified.

5.3 Platform protection

In cases of confirmed suspicion of fraud, money laundering, or criminal activity, relevant data may be shared with law enforcement agencies and partner fraud prevention platforms to protect other 26a27 users.

6. Data Retention

26a27 retains personal data for as long as necessary to fulfill each purpose stated in this policy. General retention criteria are:

• While the account is active: all data necessary for the operation of the service is retained for as long as the account remains active.
• After account closure: identification data, financial transaction history, and betting records are retained for up to five years after account closure, as required by Brazilian anti-money laundering legislation and tax obligations.
• Support data: support records are kept for up to two years for dispute resolution purposes.
• Usage data and logs: retained for up to 12 months for security and platform analytics purposes, after which they are anonymized or deleted.
• Consent data: consent records (including revocations) are retained for five years as evidence of LGPD compliance.

At the end of the retention period, data is securely deleted or anonymized so that the data subject can no longer be identified.

7. Information Security

26a27 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or improper disclosure. Key measures include:

• SSL/TLS Encryption: all communications between your device and the 26a27 platform are encrypted, including Pix deposits and withdrawals.
• Data segmentation: personal data and financial data are stored in separate systems with distinct access controls.
• Internal access control: only employees with a proven operational need have access to users' personal data, and all are bound by confidentiality agreements.
• Continuous monitoring: intrusion detection and anomaly monitoring systems track 26a27's infrastructure in real time.
• Incident response plan: in the event of a security incident that may affect your data, 26a27 will notify the affected data subjects and the ANPD (National Data Protection Authority) within the legally required timeframes — no more than 72 hours after the incident is identified.

Despite all the measures we have in place, no system is 100% immune to threats. That's why we also encourage you to follow good security practices: use a strong, unique password for your 26a27 account, enable two-factor authentication in your dashboard, and never share your login credentials with anyone.

8. Cookies and Similar Technologies

26a27 uses cookies and similar technologies for three main purposes:

8.1 Essential Cookies

Required for the platform's basic functionality — they keep your session active while you browse, remember your language preferences and account settings, and ensure transaction security. These cookies cannot be disabled without affecting the service's core functionality.

8.2 Analytics Cookies

Used to understand how users interact with the 26a27 platform — which pages get the most traffic, where navigation errors occur, and how to improve the overall experience. The data collected is aggregated and does not identify individual users. You can opt out of these analytics from your account settings panel.

8.3 Personalization Cookies

These allow 26a27 to tailor the content you see based on your usage history — such as suggesting betting categories you have previously explored or highlighting promotions relevant to your gaming profile. These cookies are only activated with your explicit consent.

9. Protection of Minors

The 26a27 platform is intended exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has provided data to 26a27 without their legal guardian's consent, please contact our DPO immediately at privacidade@26a27.net so the data can be deleted as quickly as possible.

By creating an account on 26a27, the user confirms they are 18 years of age or older. If there is any suspicion that the platform is being used by a minor, the account is immediately suspended pending investigation, the balance is held, and the case is handled in accordance with applicable Brazilian law.

10. Your Rights as a Data Subject

Under the LGPD, you have the following rights regarding your personal data processed by 26a27, exercisable at any time through the support channel or by emailing privacidade@26a27.net:

• Confirmation and access: confirm whether we process your data and obtain a copy of the information we hold about you.
• Correction: request the correction of inaccurate, incomplete, or outdated data.
• Anonymization, blocking, or deletion: request that unnecessary or excessive data be anonymized, blocked, or deleted, subject to legal retention obligations.
• Portability: receive your data in a structured, machine-readable format for transfer to another service, where technically feasible.
• Information on data sharing: obtain information about which entities 26a27 has shared your data with.
• Withdrawal of consent: withdraw the consent you gave for processing activities based on that legal basis, at any time, without affecting any processing carried out prior to that withdrawal.
• Objection: object to processing carried out on the basis of legitimate interest when you believe your fundamental rights override the stated interest.
• Review of automated decisions: request human review of decisions made solely on the basis of automated data processing.

The response deadline for data subject rights requests is up to 15 business days from receipt of the request. For more complex cases requiring additional review, the deadline may be extended by a further 15 business days, with notice to the user.

11. International Data Transfers

Some of the service providers that support 26a27's operations — such as cloud infrastructure providers and live casino studios — may be located outside Brazil. In those cases, international data transfers only occur when:

• The destination country provides an adequate level of data protection, as recognized by the ANPD; or
• The foreign recipient provides sufficient data protection guarantees through contracts with standard data protection clauses; or
• The transfer is necessary for the performance of the contract between 26a27 and the user.

You can obtain specific information about international transfers affecting your data by contacting the 26a27 DPO through the privacy channel.

12. Changes to This Policy

26a27 may update this Privacy Policy to reflect changes in data processing practices, legal requirements, or improvements to the services offered. Significant changes will be communicated by email and platform notification at least 14 days before they take effect.

The date of the last update is always shown at the top of this policy. Continued use of the 26a27 platform after any changes take effect constitutes acceptance of the revised policy. If you disagree with the changes, you may close your account before the effective date and request deletion of your data.

13. Contact the DPO

To exercise any right set out in this policy, clarify questions about how your data is processed, or file a complaint, please contact 26a27's Data Protection Officer (DPO):

• Privacy email: privacidade@26a27.net — dedicated channel for personal data matters. Response time of up to 15 business days.
• Live chat: available 24 hours a day on the platform for general privacy questions. For formal data subject rights requests, please use the email address above.

If you believe your rights have not been properly addressed by 26a27, you may file a complaint with the ANPD (National Data Protection Authority), as provided under Article 18, § 1º, of the LGPD.