C777 Privacy Policy – Data Protection and LGPD

This Privacy Policy applies to the sports betting and online casino platform operated under the brand c777, accessible at c777.express. For the purposes of Brazil's General Data Protection Law (LGPD), c777 acts as data controller of its users — meaning it is c777 that decides what data is collected, why, and how it is processed.

The platform is developed and maintained by a team specialized in technology, security, and Sports Betting, with an exclusive focus on the Brazilian market. All support, payment processing, and customer service are conducted in Portuguese for users residing in Brazil.

To contact our data protection team, please use the email contato@c777.express with the subject line "Privacy – LGPD". The response time for requests related to your personal data is up to 15 calendar days, as provided under the LGPD.

C777 collects different categories of data depending on how you interact with the platform. Below are the main types of information we process:

Data provided directly by you:

Data collected automatically during use:

Every piece of data collected by c777 has a specific and legitimate purpose. We do not process personal information indiscriminately. The following are the purposes for which data is processed:

• Operate your account: To create and maintain your account, authenticate your access, process bets, and display your transaction history on the platform;
• Process payments: Process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED, as well as handle withdrawals to verified accounts via Pix in up to 5 minutes;
• Identity verification (KYC): Meet legal age verification requirements (minimum 18 years), prevent money laundering, and maintain regulatory compliance;
• Security and fraud prevention: Detect suspicious access attempts, duplicate account creation attempts, and activities that violate our Terms and Conditions;
• Customer support: Answer questions, resolve complaints, and process requests you submit to the c777 support team;
• Responsible gambling: Enforce user-configured deposit limits, temporary breaks, and self-exclusions, and monitor patterns that may indicate problem gambling behavior;
• Transactional communications: Send registration confirmations, transaction notifications, and security alerts related to your account;
• Marketing communications: Send c777 offers and promotions only when you have given explicit consent to receive them — and you can opt out at any time;
• Platform improvement: To analyze usage data in aggregated and anonymized form in order to identify improvements to the user experience, fix technical issues, and develop new features.

The LGPD requires that all personal data processing be grounded in a specific legal basis. c777 applies the following legal bases in accordance with Art. 7 of Lei nº 13.709/2018:

• Contract performance (Art. 7, V): To operate your account, process bets, and execute payments via Pix — everything required to provide the service you agreed to when registering;
• Compliance with legal obligation (Art. 7, II): For identity verification (KYC), anti-money laundering compliance, and responding to requests from judicial authorities or regulatory bodies;
• Legitimate interest (Art. 7, IX): For fraud prevention, platform security, and aggregated usage analysis — always with minimal impact on user privacy;
• Consent (Art. 7, I): To send marketing communications and promotions — a basis that can be revoked by the user at any time without affecting access to the platform;
• Protection of life (Art. 7, VII): To apply responsible gambling measures when there are indications of risk to the user's well-being.

C777 does not sell personal data of its users. We do not share your information with advertising agencies, data brokers, or any company for third-party marketing purposes. Sharing only occurs in the situations listed below, all of which are strictly necessary for the operation of the service:

• Payment processors: To process deposits and withdrawals via Pix, boleto, credit/debit card, PicPay, and Mercado Pago. These partners receive only the data strictly necessary to complete the transaction and are contractually required to protect it in accordance with the LGPD;
• Casino and betting software providers: To provide live casino games, slots, crash games, and other products. These providers may process game session data in anonymized form for technical purposes;
• Identity verification (KYC) services: To verify the authenticity of documents submitted during the account verification process;
• Technology infrastructure: Servers, CDN, and cloud services used to host and maintain the c777 platform. All contracts with these providers include data protection clauses compatible with the LGPD;
• Legal authorities: When required by court order, law enforcement request, or a competent regulatory authority, in accordance with applicable Brazilian law.

All partners who access c777 user data are required to sign Data Processing Agreements (DPAs) that obligate them to handle that information to the same standards of security and confidentiality required by this Privacy Policy and by the LGPD.

The security of user information is a core technical and operational priority at c777. The main protective measures in place are:

• SSL/TLS encryption: All communication between your device and c777's servers is encrypted using 256-bit SSL/TLS protocol — the same standard used by Brazilian banks and financial institutions;
• Encrypted storage: Passwords are stored using irreversible cryptographic hashing — not even our tech team can retrieve your password, only reset it;
• Two-factor authentication (2FA): Available and recommended for all users, it adds an extra layer of security beyond your password;
• Internal access control: c777 employees only have access to the data necessary to perform their specific roles, with audit logs maintained for all access;
• Suspicious activity monitoring: Automated systems detect unusual access patterns, failed login attempts, and activities that may indicate account compromise;
• Periodic security testing: The platform undergoes regular vulnerability assessments, including penetration tests (pentests) carried out by specialized teams.

C777 uses cookies and similar technologies to ensure the platform functions properly, enhance the user experience, and collect anonymized analytical data. The table below describes the types of cookies used:

You can manage non-essential cookies through your browser settings. However, disabling essential cookies may prevent login and payments from working correctly on the platform. To learn more about managing cookies on your phone or computer, check your browser's privacy settings.

C777 retains your personal data for as long as necessary for the purposes described in this policy. The general retention periods are:

• Registration and identity data (KYC): Retained for the full duration of the account and for 5 years after account closure, as required by anti-money laundering legislation (Law No. 9.613/1998);
• Financial transaction history: Retained for 5 years after each transaction, for tax audit purposes and to meet legal obligations with the Receita Federal do Brasil;
• Betting records: Maintained for 2 years after each bet is settled, for dispute resolution and compliance verification purposes;
• Session and browsing data: Retained for 12 months in anonymized form, for platform improvement analysis purposes;
• Support records: Maintained for 2 years after each support ticket is closed, to ensure quality and resolve any complaints that may arise.

Once retention periods expire, data is securely and irreversibly deleted. Data used for statistical and product improvement purposes is anonymized before any processing and cannot be used to identify individuals.

The General Data Protection Law (LGPD) grants you, as a data subject, a set of rights that c777 is committed to respecting and upholding. See each right and how to exercise it:

C777 responds to all LGPD rights requests within 15 calendar days. In cases requiring more in-depth legal review, the deadline may be extended with prior notice. If you believe your rights have not been properly addressed, you may file a complaint with the National Data Protection Authority (ANPD) through the authority's official website.

Some of the technology infrastructure and software providers used by c777 may have servers located outside Brazil. When international data transfers occur, c777 ensures they only take place under the following conditions, as set out in Art. 33 of the LGPD:

• For countries or international bodies that provide a level of personal data protection equivalent to that required under the LGPD;
• When the data recipient has provided sufficient guarantees of compliance with the principles and data subject rights set forth in the LGPD, through specific contracts or clauses;
• When the transfer is necessary to perform the contract with you, such as processing transactions through international credit card networks.

Under no circumstances are personal data of Brazilian users transferred for use in targeted advertising profiles by international third parties. Casino software providers that may process gaming data outside Brazil operate under data processing agreements compatible with the LGPD and do not retain users' identifiable data.

The c777 platform is intended exclusively for users aged 18 and over who reside in Brazil. c777 does not intentionally collect personal data from minors and does not direct any marketing communications to that audience.

If we become aware that an account was created by or on behalf of a minor under 18, the account will be immediately closed and all associated data will be deleted, except for any data required to fulfill legal obligations arising from the closure.

If you believe a minor has created an account on c777, please contact us immediately at contato@c777.express or via live chat and let us know what happened. We will treat the matter as a priority.

C777 may update this Privacy Policy periodically to reflect changes in Brazilian law, in our data processing practices, or in the services we offer. Any significant changes will be communicated to registered users by email and via an in-platform notification at least 7 days' notice.

The most current version of the Privacy Policy will always be available on this page, with the date of the last update shown in the header. We encourage you to review this document periodically to stay informed about how c777 protects your data.

Continued use of the platform after the effective date of a new version of the Privacy Policy constitutes acceptance of the updated terms. If you do not agree with the changes, you may close your account before the effective date by requesting a withdrawal of your available balance via Pix.

To exercise your rights as a data subject, ask questions about this Privacy Policy, or file a complaint regarding the handling of your information, please contact our privacy channel:

• Privacy email: contato@c777.express — use the subject line "Privacy – LGPD" so your request is directed to the responsible team;
• Live chat: Available 24 hours a day within the c777 platform for urgent questions about your account and privacy;
• Response timeframe: Up to 15 calendar days for LGPD rights requests; up to 4 hours for operational matters via email.

C777 has designated an internal data protection officer who serves as the point of contact for users and for the National Data Protection Authority (ANPD). For formal complaints about LGPD non-compliance that have not been resolved by c777, you may contact the ANPD through the official Brazilian data protection authority portal.