Kf222 Privacy Policy: How We Protect Your Data

1Who We Are — The Data Controller

The kf222 is the controller of personal data collected through the kf222.best platform. As the data controller, we are responsible for defining the purposes and means of processing the personal data of registered users, in accordance with the LGPD.

For any matter related to the processing of personal data — access requests, corrections, deletions, portability, or complaints — you may contact our Data Protection Officer (DPO) directly at contato@kf222.best, with the subject line "Data Protection – [type of request]".

2Personal Data We Collect

2.1 Data provided directly by you

During registration and use of the kf222 platform, you actively provide us with the following information:

• Registration data: full name, CPF, date of birth, email address, mobile number, and residential address;
• Identity verification data: copy of a government-issued ID (RG, CNH, or passport), a selfie for confirmation, and proof of address;
• Financial data: Pix key, credit or debit card details (processed via tokenization — we never store the full card number), and PicPay or Mercado Pago account details used for deposits;
• Communications: messages exchanged with support via live chat or email, including full service history.

2.2 Automatically collected data

When you access and use the kf222 platform, we automatically collect:

• Access data: IP address, browser type and version, operating system, device used (mobile, tablet, computer), language, and time zone;
• Browsing data: pages visited, games accessed, session duration, clicks, and interactions with the platform interface;
• Transaction data: deposit and withdrawal history, bets placed, winnings, bonuses activated, and cash out usage;
• Cookies and similar technologies: detailed in Section 8 of this policy.

3How We Use Your Personal Data

Kf222 uses the personal data collected exclusively for the following purposes:

• Account operation: create and manage your account, process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago, and provide access to games and Sports Betting;
• Identity verification and fraud prevention: verify your identity, prevent fraudulent use of the platform, detect multiple accounts, and identify suspicious money laundering activity;
• Compliance with legal obligations: to meet the regulatory requirements applicable to the online entertainment market in Brazil, including tax, accounting, and reporting obligations to the relevant authorities;
• Customer support: answer questions, resolve issues, and continuously improve support based on recorded interactions;
• Responsible gambling: monitor gameplay patterns to identify at-risk behavior and activate the responsible gambling protections set out in kf222's policy;
• Marketing communications: to send promotions, bonuses, and platform updates — only to users who have expressly consented to receive such communications, with an unsubscribe option included in every email sent;
• Platform improvement: analyze aggregated and anonymized usage data to understand how the kf222 platform is used and identify opportunities to improve the user experience.

4Legal Bases for Data Processing

All personal data processing carried out by kf222 is based on one of the legal grounds established under the LGPD:

• Contract performance (Art. 7, V): processing is necessary to deliver the services agreed upon at registration — account management, deposits, bets, and withdrawals;
• Compliance with legal obligation (Art. 7, II): kf222 is legally required to retain certain records for tax, regulatory, and anti-money laundering purposes;
• Legitimate interest (Art. 7, IX): for fraud prevention, platform security, and responsible gambling monitoring — activities that protect both the user and the integrity of the platform;
• Consent (Art. 7, I): for sending marketing communications and for the use of non-essential cookies. This consent may be withdrawn at any time.

5Data Sharing with Third Parties

Kf222 does not sell, rent, or trade personal data of users. Data is shared with third parties only in the following situations:

5.1 Essential operational partners

• Payment processors: to process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago. Only the minimum data required for the transaction is shared;
• Game providers: Pragmatic Play, PG Soft, Evolution Gaming, and other partners receive technical session data (anonymized identifier, balance) for game functionality — never complete personal data;
• Identity verification services: specialized KYC (Know Your Customer) partners who assist with identity verification — operating under data processing agreements that ensure a level of protection equivalent to that required by the LGPD.

5.2 Legal obligations

Kf222 may share data with government authorities, regulatory bodies, or the judiciary when required by law, court order, or a formal investigation conducted by the competent Brazilian authorities.

6Data Retention — How Long We Keep Your Data

Kf222 retains users' personal data for as long as necessary to fulfill the stated purposes and for the period required by applicable legal obligations:

• Registration and identification data: retained for the full duration of the active account and for up to 5 years after account closure, as required by financial compliance and anti-money laundering regulations;
• Transaction history: retained for 5 years for tax and accounting purposes, in accordance with Brazilian tax legislation;
• Access records and security logs: retained for 6 months, pursuant to the Brazilian Internet Civil Rights Framework (Law No. 12.965/2014);
• Support communications: retained for 2 years for quality assurance and dispute resolution;
• Marketing data (with consent): retained for as long as the account remains active or until consent is withdrawn, whichever comes first.

Once retention periods have expired, data is securely deleted or anonymized in a way that makes it impossible to identify the data subject.

7Information Security

Kf222 implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, alteration, unauthorized disclosure, or destruction:

• 256-bit SSL Encryption across all communications between the user's device and kf222 servers;
• Tokenization of credit and debit card data — kf222 never stores the full card number, only a token that cannot be reversed to the original data;
• Role-based access control — only kf222 staff with a verified operational need are granted access to users' personal data;
• Continuous monitoring of unauthorized access attempts, brute-force attacks, and other security threats;
• Two-factor authentication (2FA) available and recommended for all users when accessing their kf222 account;
• Security audits periodic reviews conducted by internal teams and, where applicable, by independent external auditors.

Despite all measures in place, no system is 100% invulnerable. In the event of a security incident that may affect your personal data, kf222 will notify affected users and the ANPD within the timeframes established by the LGPD — generally within 2 business days of the incident being identified.

8Cookies and Similar Technologies

Kf222 uses cookies and similar technologies to ensure the platform functions correctly, enhance the user experience, and — with your consent — personalize content and analyze usage. The types of cookies used are described below:

You can manage your cookie preferences at any time through your browser settings. Disabling essential cookies may prevent the kf222 platform from functioning properly.

9International Data Transfer

Some of kf222's operational partners — particularly game providers and server infrastructure providers — may be based outside Brazil. When this occurs, kf222 ensures that the international data transfer meets the requirements of the LGPD:

• The destination country offers an adequate level of personal data protection, as assessed by the ANPD, or
• The transfer is covered by standard contractual clauses that ensure a level of protection equivalent to that required by Brazilian law, or
• The transfer is necessary to perform the contract with the user — such as providing access to a game offered by an international partner studio.

In all cases, internationally transferred data is limited to the minimum necessary for the specific operation, and international partners are contractually prohibited from using that data for any other purpose.

10Minors

Kf222 is a platform intended exclusively for users aged 18 years of age or older. We do not intentionally collect personal data from individuals under 18 years of age. By creating an account on kf222, the user confirms they are at least 18 years old.

If kf222 identifies that a user is under 18 — whether through voluntary disclosure, documentation submitted during the verification process, or any other means — the account will be immediately closed, the balance refunded, and all personal data related to the minor deleted within the legally permitted timeframes.

11How to Exercise Your Rights

To exercise any of the rights provided under the LGPD regarding your personal data at kf222, you can:

• Live chat — available 24 hours a day, 7 days a week, directly on the platform. Let the agent know you wish to exercise a privacy right and specify which request you would like to make;
• Email contato@kf222.best — use the subject line "Privacy – [request type]" (e.g., "Privacy – Data Access" or "Privacy – Account Deletion"). Our team responds within 48 business hours in Portuguese.

To process your request, we may need to verify your identity to ensure we are providing information to the correct account holder. We typically ask for confirmation of the registered email address, and for more sensitive requests such as account deletion, submission of a government-issued ID may be required.

12Changes to this Privacy Policy

Kf222 may update this Privacy Policy periodically to reflect changes in data processing practices, Brazilian legislation, or the services offered. When there are material changes that affect your rights or how your data is handled, you will be notified:

• Via the email address registered on the platform, with at least 7 days in advance before the new version takes effect;
• Via a visible notice in your kf222 account dashboard during the transition period.

The date of the most recent update is always shown at the top of this document. A history of previous versions of the Privacy Policy may be requested by emailing contato@kf222.best. If you do not agree with the changes, you may request account closure before the new version's effective date.

13Contact, DPO & Additional Information

Kf222 has appointed a Data Protection Officer (DPO) responsible for overseeing LGPD compliance and serving as the point of contact for users and the ANPD on privacy matters.

To contact kf222's DPO or the privacy team:

• Email: contato@kf222.best — subject line "DPO / Data Protection"
• Live chat: available 24 hours on the kf222.best platform

If, after contacting kf222, you believe your rights have not been adequately addressed, you have the right to file a complaint with the ANPD — National Data Protection Authority, the regulatory body responsible for enforcing the LGPD in Brazil.