877x Privacy Policy – Data Protection and LGPD

1. What data we collect

877x collects only the data necessary to deliver platform services, meet legal obligations, and ensure the security of all users. Below we detail the categories of data collected and the source of each.

1.1 Data Provided Directly by You

When you register and use the 877x platform, you voluntarily provide the following information:

• Identification data: full name, CPF, date of birth, RG or CNH (for KYC verification);
• Contact data: email address, mobile number with area code, full residential address including ZIP code;
• Access credentials: username and password (stored in hash format — never as plain text);
• Financial data: Pix key details, credit or debit card information (processed via PCI-DSS certified gateways), deposit receipts, and transaction history;
• Verification documents: photo of a government-issued photo ID (front and back) and a selfie for the KYC process, completed once before your first withdrawal.

1.2 Automatically collected data

When you use the 877x platform — on the website or app — we automatically collect certain technical data required for the services to function:

• Device data: device type, operating system, app or browser version, language, and time zone;
• Connection data: IP address, access date and time, pages visited, session duration;
• Usage data: betting history, games accessed, platform interactions, and game preferences;
• Cookies and similar technologies: as described in Section 8 of this Policy.

1.3 Third-party data

In specific situations — such as fraud prevention and identity verification — 877x may receive data from credit bureaus, document verification tools, and authorized KYC service providers. This data is used solely for the stated purposes and is handled with the same level of protection as data collected directly from you.

2. How We Use Your Data

877x uses the data collected for the following purposes, always limited to the minimum necessary for each objective:

2.1 Service delivery

• Create and manage your 877x account;
• Process deposits and withdrawals via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, and TED transfer;
• Place and settle Sports Betting on Brasileirão, Copa do Brasil, Libertadores, volleyball, NBB basketball, UFC, and other available markets;
• Provide access to casino games, live blackjack, progressive jackpot slots, and crash games;
• Provide support in Portuguese via live chat and email.

2.2 Security and compliance

• Verify user identities (KYC) in accordance with regulatory requirements;
• Prevent fraud, money laundering, and misuse of the platform;
• Detect and investigate suspicious activity or violations of the Terms and Conditions;
• Fulfill legal obligations imposed by Brazilian law.

2.3 Platform Improvement

• Analyze usage patterns to improve the experience on 877x;
• Test and roll out new features and functionality;
• Personalize game and betting recommendations based on your history (with the option to disable this at any time in your account panel).

2.4 Communications

• Send mandatory transactional notifications: deposit confirmation, bet settlement, processed withdrawal, and Terms updates;
• Send marketing communications about promotions, new games, and bonuses — only with your consent and with the option to unsubscribe at any time.

3. Legal basis for processing

All data processing carried out by 877x has a legal basis under the LGPD. Below we detail the bases used for each category of processing:

• Contract performance (art. 7, V): processing required to fulfill the service agreement entered into at registration — account creation, payment processing, and bet recording;
• Compliance with a legal obligation (art. 7, II): KYC identity verification, anti-money laundering compliance, and other Brazilian regulatory requirements;
• Legitimate interest (art. 7, IX): usage data analysis to improve the platform, fraud prevention, and security of 877x systems;
• Consent (art. 7, I): sending marketing communications and personalizing recommendations. Consent may be withdrawn at any time without affecting other services.

4. Data Sharing

877x does not sell your personal data to third parties. Information is shared only in strictly necessary situations as described below.

4.1 Service partners (processors)

To operate the platform, 877x uses service providers acting as data processors under contractual instruction from 877x, including:

• Payment gateways: required to process transactions via Pix, boleto, card, PicPay, Mercado Pago, and TED. These partners receive only the minimum data necessary to process each transaction and are all PCI-DSS certified;
• KYC providers: for identity and document verification, where applicable;
• Live casino providers: such as Evolution Gaming, which may receive technical session data to operate live tables. This data does not include financial information beyond what is necessary to process the current bet;
• Support platforms: for live chat operations and ticketing system. Support data is securely stored and used solely for resolving service requests.

4.2 Authorities and legal compliance

877x may share data with public authorities — such as the Receita Federal, Polícia Federal, and Banco Central — when required by court or regulatory order, strictly to the extent necessary and notifying the user whenever legally permitted.

5. How long we retain your data

877x retains your personal data for as long as necessary to fulfill the purposes described in this Policy and to meet applicable legal obligations. The general retention criteria are:

• Active account data: retained for as long as you hold an active account with 877x;
• Financial and transaction data: retained for a minimum of 5 years after the transaction, as required by Brazilian tax and anti-money laundering legislation;
• KYC data (identity documents): retained for a minimum of 5 years after account closure, in accordance with regulatory requirements;
• Betting history: available to the user for the duration of the account and retained internally for 5 years after closure;
• Marketing data (with consent): retained until consent is withdrawn by the user;
• Security and access logs: retained for 12 months for incident investigation purposes.

Once the applicable retention period has expired, data is securely deleted or irreversibly anonymized so that it can no longer be linked to the data subject.

6. How We Protect Your Data

877x implements robust technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure.

6.1 Technical measures

• 256-bit SSL encryption on all communications between client and server;
• Passwords stored exclusively in bcrypt hash format — never as plain text;
• Financial data processed by PCI-DSS Level 1 certified gateways;
• Server infrastructure with continuous 24-hour monitoring by a dedicated security team;
• Role-based access control: only team members with a justified need can access user data, always within an audited environment;
• Regular penetration testing (pentest) conducted by independent specialized firms.

6.2 Organizational measures

• Mandatory data protection and LGPD training for all 877x staff;
• Internal minimum necessary access policy (principle of least privilege);
• Documented security incident response process, including notification to the ANPD and affected data subjects when required by the LGPD;
• Data processing agreements with all partners acting as processors, ensuring the same standards of protection.

Despite all efforts, no system is 100% invulnerable. In the event of a security incident that may affect your data, 877x will notify impacted users and the National Data Protection Authority (ANPD) within the timeframes required by the LGPD.

7. Your rights as a data subject

The LGPD grants you a set of rights regarding your personal data processed by 877x. All rights can be exercised through the DPO contact channel described in Section 10 of this Policy, free of charge and within the statutory timeframes.

877x will respond to rights requests within 15 business days. For more complex cases requiring additional identity verification or legal review, the deadline may be extended by a further 15 business days, with prior notice to the data subject.

8. Cookies and tracking technologies

877x uses cookies and similar technologies to ensure the platform functions correctly, analyze service usage, and personalize your experience. See below for the categories of cookies used:

You can manage your cookie preferences at any time through the privacy settings panel, accessible from your account menu. Blocking essential cookies may affect certain 877x features, such as keeping your session active and processing bets.

9. Protection of Minors

The 877x platform is intended exclusively to users aged 18 and over. 877x does not intentionally collect personal data from minors. The KYC verification process includes age confirmation as a mandatory step.

If you suspect that a minor has created an account on 877x, please contact our support team immediately via live chat or by emailing suporte@877x.best. The account will be suspended pending investigation and, if the user is confirmed to be underage, all data will be deleted and any deposited funds will be returned to the legal guardian.

For parents and guardians who share devices with minors, 877x recommends using the parental control tools available on Android and iOS, and to never stay logged in to 877x on devices shared with children or teenagers.

10. Data Protection Officer (DPO)

877x has appointed a Data Protection Officer (DPO) responsible for ensuring LGPD compliance and handling data subject requests.

To exercise any of the rights described in Section 7 of this Policy, or to ask questions about how 877x handles your data, please reach out through our dedicated channel:

• DPO Email: privacidade@877x.best
• General support email: suporte@877x.best
• Live chat: available 24 hours a day, 7 days a week, in Portuguese

When reaching out, please provide your full name, the CPF registered with 877x, and a clear description of your request. For data deletion or portability requests, additional identity verification may be required to ensure that data is delivered or deleted only upon a legitimate request from the data subject.

11. Updates to This Policy

This Privacy Policy may be updated periodically to reflect changes in legislation, 877x's services, or data protection practices. When material changes are made, 877x will notify registered users by email at least 7 days before the new version takes effect.

The most current version of this Policy is always available on this page, with the date of the last revision indicated at the top. By continuing to use the platform after a new version takes effect, you confirm that you have read and accepted the changes. If you do not agree with the updates, you may request account closure as described in the Terms and Conditions of 877x prior to the effective date.