Privacy Policy cc9999 – Your Data Protected

A cc9999, operator of the platform available at cc9999.best, is the controller of personal data for players registered in Brazil, as defined by the LGPD (Lei nº 13.709/2018). This means cc9999 is the entity responsible for determining how and why your data is collected and processed.

Cc9999 has appointed a Data Protection Officer (DPO) to oversee all privacy practices and ensure compliance with Brazilian law. The DPO's contact details are available in section 10 of this document.

This Privacy Policy applies to all users who access or use any cc9999 service, including the website, the mobile version, and any future platform interface. By creating an account or making a deposit at cc9999, you confirm that you have read and understood how your data is handled.

Cc9999 collects only the data necessary to operate the platform, process payments, and meet legal obligations. Below is a clear description of each category of data we collect:

Cc9999 does not collect sensitive data such as racial origin, religious beliefs, biometric data, or health information, except where strictly necessary to fulfill specific legal obligations related to responsible gambling — and always on an appropriate legal basis under the LGPD.

Each use of your data at cc9999 has a clear legal basis established under the LGPD. Below are the processing purposes and their respective legal grounds:

• Account creation and management — required for the performance of a contract (art. 7º, V, LGPD). Without this data, it is not possible to create an account or access the cc9999 platform;
• Processing deposits and withdrawals — required for contract performance. Financial data is used to process transactions via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and bank transfer (Nubank, Itaú, Bradesco, Banco do Brasil, and others);
• Identity verification (KYC) — compliance with a legal obligation (art. 7º, II, LGPD) related to anti-money laundering regulations and age verification;
• Fraud prevention and account security — legitimate interest of both cc9999 and the player in maintaining platform security;
• Player support — required for the performance of a contract and to provide adequate support via live chat and the support email address;
• Marketing communications and promotions — based on the player's consent (art. 7º, I, LGPD). You may withdraw this consent at any time;
• Responsible gambling and pattern monitoring — legitimate interest and compliance with legal obligations. cc9999 monitors usage patterns to identify behaviors that may indicate problem gambling;
• Platform analysis and improvement — legitimate interest to continuously improve the experience of Brazilian players at cc9999.

Cc9999 never uses your data for purposes beyond those listed above without prior notice and, where required, obtaining fresh consent. If a new purpose arises, this policy will be updated and you will be notified.

Cc9999 does not sell player data to third parties under any circumstances. Data sharing occurs only in the situations below, always with an appropriate legal basis and confidentiality safeguards:

• Payment processors — to process deposits and withdrawals via Pix, boleto, card, and other Brazilian payment methods. These partners receive only the minimum data required to complete the transaction and operate under confidentiality agreements;
• Game providers — slots, Live Casino, and Sports Betting providers integrated into the cc9999 platform receive anonymous identifiers to record game outcomes, never complete personal data such as CPF or address;
• Identity verification services (KYC) — to validate documents during the verification process required under anti-money laundering regulations;
• Regulatory and judicial authorities — when required by Brazilian law, court order, or request from a competent regulatory authority. cc9999 cooperates fully with legitimate authorities and notifies the player whenever legally permitted;
• Independent auditors — for LGPD compliance audits, RNG system audits, and security reviews. Auditors operate under strict non-disclosure agreements (NDAs).

All third parties that receive player data from cc9999 are contractually required to handle that information with the same level of confidentiality and security that cc9999 upholds internally, in compliance with the LGPD.

Cc9999 uses cookies and similar technologies to ensure the platform works correctly and to improve the player experience. The types of cookies used are:

• Essential cookies — required for the platform to function. Without them, you cannot log in, maintain an active session, or place bets. These cookies cannot be disabled;
• Preference cookies — store settings such as language, preferred payment method, and interface preferences. They can be disabled, but some features may be affected;
• Analytical cookies — collect aggregated data on how players use the cc9999 platform (most visited pages, session duration, errors encountered). Used solely to improve the platform. They do not identify you individually;
• Security cookies — used to detect suspicious behavior, unauthorized access attempts, and fraud. Essential to keeping your account secure.

Cc9999 does not use behavioral advertising cookies from third parties that track your browsing on other sites. If you visit cc9999 through a marketing campaign, we may use conversion cookies solely to measure the internal effectiveness of that campaign — never to track your activity outside the platform.

You can manage your cookie preferences through your account settings panel or your browser settings. On mobile (Android or iOS), your browser's cookie settings apply to cc9999's mobile access in the usual way.

Cc9999 applies multiple layers of security to protect the data of Brazilian players. The main technical and organizational measures currently in place are:

• 256-bit SSL/TLS encryption across all communications between the client (mobile or desktop) and cc9999's servers;
• Financial data tokenization — card numbers and banking details are never stored in readable form. Only encrypted tokens are retained in cc9999's systems;
• Two-factor authentication (2FA) available to all players and mandatory for financial operations above certain thresholds;
• Continuous access monitoring — automated systems detect unauthorized access attempts and automatically block suspicious IPs;
• Internal access control — cc9999 staff access player data only when necessary to perform their duties. All access is recorded in auditable logs;
• Encrypted backups on geographically redundant servers, ensuring data availability and integrity even in the event of hardware failure;
• Penetration testing regularly conducted by independent security teams to identify and fix vulnerabilities before they can be exploited.

In the event of a security incident involving personal data that poses a real risk to data subjects, cc9999 will notify the ANPD (National Data Protection Authority) and the affected players within the legal deadline of 2 business days after the incident is identified, in accordance with art. 48 of the LGPD.

The LGPD grants you, as the data subject whose personal data is processed by cc9999, a set of rights that can be exercised at any time, free of charge and without hassle. Here is each one:

Cc9999 retains personal data only for as long as necessary to fulfill the purposes for which it was collected or to meet legal obligations. The applicable retention periods are:

• Active account data — retained for as long as the account remains active on the cc9999 platform. After account closure, data is moved to secure storage with restricted access;
• Financial and transaction data — retained for at least 5 (five) years after the last transaction, as required by Brazilian anti-money laundering regulations (Law No. 9.613/1998) and the Federal Revenue Service;
• Identity verification documents (KYC) — retained for at least 5 (five) years after account closure, in accordance with applicable regulatory requirements;
• Game and betting history — retained for 3 (three) years after account closure, for dispute resolution and integrity audit purposes;
• Access and security logs — retained for 6 (six) months for security purposes and incident investigation, in accordance with the Brazilian Internet Civil Rights Framework (Law No. 12.965/2014);
• Marketing communications data — deleted within 30 days after consent is withdrawn by the account holder.

Once retention periods have elapsed, data is securely and permanently deleted from cc9999's systems, except where a specific court order or regulatory requirement justifies extended retention.

Cc9999 may update this Privacy Policy periodically to reflect changes in platform practices, Brazilian legislation (such as LGPD updates), or the technologies used. Any material update will be communicated as follows:

• Prominent notice on the cc9999 platform for at least 7 days before the changes take effect;
• Email notification to all players with an active account, summarizing the key changes;
• Update of the effective date at the top of this document.

Continued use of cc9999 after the effective date of an updated version of this policy constitutes acceptance of the new terms. If you do not agree with the updates, you may close your account and request a withdrawal of your available balance before the effective date.

The most current version of this Privacy Policy is always available on this page at cc9999.best/privacy-policy. Previous versions may be requested via the support email for reference purposes.

To exercise your rights as a data subject, ask questions about this Privacy Policy, or report any concerns regarding cc9999's handling of your personal data, please use the channels below:

• Privacy email: suporte@cc9999.best — include "LGPD Request" in the subject line for direct routing to the DPO;
• Live chat: available 24 hours a day on the cc9999 platform, in Portuguese. For privacy-related matters, ask the support agent to transfer you to the data protection channel;
• Response time: up to 15 business days for formal data subject requests under the LGPD; up to 48 business hours for general privacy inquiries via chat or email.

The Data Protection Officer (DPO) of cc9999 is the designated point of contact for overseeing privacy practices and liaising with the ANPD as needed. The DPO can be reached at the same email address above, with a clear indication of the subject matter.

For complaints that have not been resolved satisfactorily by cc9999, the player may contact the ANPD (National Data Protection Authority) — the federal authority responsible for overseeing LGPD compliance in Brazil.