A555 Privacy Policy

For the purposes of the General Data Protection Law (LGPD — Lei nº 13.709/2018), the a555 is the controller of personal data collected and processed within the sports betting and online casino platform accessible at a555.world.

A a555 has appointed a Data Protection Officer (DPO), responsible for receiving communications from data subjects and from the Autoridade Nacional de Proteção de Dados (ANPD). The DPO can be reached at suporte@a555.world with the subject line "Data Privacy — LGPD".

This Privacy Policy applies to all registered users of the a555, including non-registered visitors who access the site and anyone who interacts with the Android or iOS app. By using the platform, you acknowledge that you have read and understood this policy.

A a555 collects different categories of personal data depending on how you interact with the platform. The table below describes the main types of data collected and when collection takes place:

A a555 does not collect sensitive personal data — such as racial origin, religious belief, political opinion, or health data — except where strictly necessary to fulfill specific legal obligations, such as responsible gambling programs involving vulnerability self-assessment.

We do not intentionally collect data from users under 18. If we identify that a minor has provided personal data, the account will be closed and the data deleted immediately. For details, see Section 10 of this policy.

A a555 uses collected personal data solely for the purposes described below. No data is processed for purposes incompatible with those listed in this section:

• Platform operation: account creation and management, processing of deposits and withdrawals via Pix, bank slip, credit and debit card, PicPay, Mercado Pago, and TED, as well as recording of bets and results.
• Identity verification (KYC): account holder identity verification to meet legal anti-money laundering requirements and to protect users against unauthorized account access.
• Fraud prevention: detection of suspicious behavior patterns, use of multiple accounts, fraudulent chargebacks, and other conduct prohibited under a555's Terms and Conditions.
• Essential communications: registration confirmations, financial transaction notifications, security alerts (such as unrecognized login attempts), and responses to support requests.
• Marketing communications: emails and push notifications about promotions, bonuses, and special odds for the Copa do Brasil, Brasileirão, and other products — only with your prior consent and with the option to opt out at any time.
• Responsible gambling: monitoring of gameplay patterns that may indicate problem behavior, in order to activate protective tools and reach out to the user when necessary.
• Product improvement: aggregated usage analysis (with no individual identification) to improve the live betting, casino, slots, and other a555 features experience.
• Compliance with legal obligations: data retention to comply with requirements from Brazilian tax, judicial, or regulatory authorities.

In compliance with the LGPD, all personal data processing carried out by the a555 is grounded in at least one of the following legal bases:

• Contract performance (art. 7, V of the LGPD): processing is necessary to perform the service agreement entered into when you register with a555 — without processing your identification, registration, and transaction data, it is not possible to create your account, process deposits and withdrawals via Pix, or record your bets.
• Compliance with a legal or regulatory obligation (art. 7, II of the LGPD): KYC and financial transaction data are retained to fulfill anti-money laundering obligations (Lei nº 9.613/1998), tax compliance requirements, and Banco Central do Brasil regulations related to the Pix system.
• Legitimate interest (art. 7, IX of the LGPD): fraud prevention, platform security, and essential operational communications are based on a555's legitimate interest in maintaining a safe environment for all members.
• Consent (art. 7, I of the LGPD): marketing communications, such as promotional emails about bonuses and special odds for the Brasileirão, are sent solely based on your consent, given at registration. You can withdraw this consent at any time in your account settings or via the unsubscribe link included in every email.

A a555 does not sell users' personal data. Sharing with third parties occurs only in the specific, necessary situations listed below, always with the minimum data required for the stated purpose:

• Payment processors: credit and debit card gateways (PCI-DSS certified), Pix network operators, PicPay, and Mercado Pago receive only the data necessary to process the specific transaction. a555 does not share users' full betting history with payment processors.
• KYC providers: document verification may be processed by a specialized identity verification provider, which receives user-submitted documents under a confidentiality agreement and is required to delete them after the review.
• Game providers: for live casino games and slots from third-party providers (such as Pragmatic Play and Evolution Gaming), minimal session data is shared to initialize the game. These providers operate under data processing agreements with a555.
• Competent authorities: a555 may share data with the Receita Federal do Brasil, Banco Central, Ministério Público, judiciary, or other authorities when required by law, court order, or valid administrative proceeding.
• Infrastructure providers: hosting servers and cybersecurity services that process data as sub-processors of a555, under contracts with data protection clauses equivalent to LGPD requirements.

All third parties that receive personal data from users of the a555 are bound by contracts requiring compliance with the LGPD and prohibiting the use of data for any purpose beyond what was agreed. A a555 does not transfer data to countries that do not offer a level of protection equivalent to Brazilian law without the appropriate safeguards set out in the LGPD.

The LGPD grants you, as the data subject whose personal data is processed by a555, the following rights, exercisable at any time by emailing suporte@a555.world with the subject line "LGPD Rights":

Rights exercise requests are fulfilled within 15 (fifteen) business days from the date of receipt. For complex requests, this deadline may be extended by an additional 15 days, with prior notice to the user. The a555 may request identity verification before processing sensitive requests — such as data access or account deletion — to prevent unauthorized third parties from exercising rights on your behalf.

If you believe your rights have not been adequately addressed by a555, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), following the procedures available on the authority's official portal.

A a555 uses cookies and similar technologies on the website and app to ensure the platform functions correctly, personalize your experience, and analyze usage in aggregate. When you visit the site for the first time, you will see a cookie notice with the option to accept or customize your preferences.

The types of cookies used by the a555 are:

• Essential cookies: required for the platform's core functionality — session authentication, bet slip, language and currency preferences. These cannot be disabled without affecting your use of the platform.
• Performance cookies: collect anonymized data on how users navigate the site — which pages are visited most, load times, errors encountered — for technical improvement purposes. They do not identify individual users.
• Functionality cookies: remember preferences such as recent betting history, favorite leagues (Brasileirão, Copa do Brasil), and notification settings. They can be disabled without affecting core functionality.
• Marketing cookies: used to display personalized offers within the platform, such as targeted bonuses for football bettors or slots players. These require prior consent and can be disabled in cookie settings at any time.

A a555 does not use third-party tracking pixels for advertising on external networks. Third-party cookies present on the platform are limited to live casino and slots game providers, which use them solely to initialize and manage the game session.

To manage or delete cookies already stored, you can access your browser or app settings. Deleting essential cookies may require you to log in again and reset some saved preferences.

A a555 implements technical and organizational measures to protect users' personal data against unauthorized access, accidental loss, destruction, or improper disclosure. The key measures in place include:

• 256-bit SSL/TLS encryption on all communications between the user's device and a555's servers.
• Passwords are stored using cryptographic hashing — they are never stored in plain text, and no a555 employee has access to your password.
• Two-factor authentication (2FA) available to all users and mandatory for staff members with access to personal data.
• Continuous monitoring of access and transactions through intrusion detection and anomalous behavior analysis systems.
• Regular security testing, including vulnerability assessments and penetration tests conducted by independent teams.
• Environment segregation — the production database is isolated from development and testing environments, with no real data stored in non-production environments.
• A documented security incident response procedure, including notification to the ANPD and affected data subjects within the timeframe established by the LGPD in the event of a data breach.

In the event of a security incident that may affect your personal data, the a555 will notify affected users by email, describing the nature of the incident, the data involved, the measures taken, and recommendations on how to protect your information.

A a555 retains users' personal data only for as long as strictly necessary for the purposes that justified its collection, in compliance with the legal retention periods applicable to the online betting and entertainment sector in Brazil.

The retention periods applicable to the main data categories are:

• Registration and identification data: for as long as the account remains active. After account closure, retained for up to 5 (five) years to meet tax and legal obligations, after which they are deleted or anonymized.
• Financial transaction data (deposits and withdrawals): 5 (five) years from the transaction date, as required by tax compliance and anti-money laundering regulations.
• KYC documents (RG, CNH, proof of address): for as long as the account remains active, plus 5 years after closure. Physical and digital copies are destroyed at the end of this period.
• Betting and game history: for as long as the account is active. After closure, retained for 2 (two) years in anonymized format for statistical analysis.
• Support communication data: 2 (two) years from each interaction, for internal quality audit purposes.
• Session cookies: deleted when you end the browser session or after the inactivity period configured in the app.

Once retention periods expire, data is securely deleted or anonymized in a way that makes it impossible to identify the data subject. The anonymization process follows a methodology that prevents re-identification even when cross-referenced with other databases.

The platform of a555 is restricted to users aged 18 or older. We do not knowingly collect personal data from anyone under 18. The registration form requires a declaration of legal age, and KYC verification confirms age via official document.

If you are a parent or guardian and believe that a user under 18 has created an account on the a555 or accessed the platform, contact us immediately at suporte@a555.world. The a555 will:

• Suspend account access immediately upon notification.
• Review the situation and close the account if underage ownership is confirmed.
• Delete all personal data associated with the minor's account upon closure.
• Return any real-money balances to the legal guardian, upon proof of guardianship.

A a555 also provides information on parental controls for parents and guardians who want to restrict minors' access to sports betting and online casino platforms. Contact support for recommendations on parental control tools compatible with the most widely used devices and browsers in Brazil.

A a555 may periodically update this Privacy Policy to reflect changes in Brazilian data protection legislation, the services offered, or internal data processing practices. Every updated version will be published on this page with a revised "last updated" date at the top of the document.

For material changes — involving new processing purposes, new categories of data collected, or changes to your rights as a data subject — the a555 will send an email notification at least 7 (seven) days in advance. In cases where a legal requirement allows less notice, notification will be sent as soon as possible.

Continued use of the platform after non-material changes are published constitutes acknowledgment of the updated version. For material changes, we will ask for your active confirmation upon your next login.

To exercise your rights as a data subject, clarify questions about this Privacy Policy, or report concerns regarding the processing of your personal data by a555, please contact our Data Protection Officer (DPO):

• Email: suporte@a555.world (subject: "Data Privacy — LGPD")
• Live chat: available 24 hours a day on the a555 website and app
• Response time: up to 15 business days for formal LGPD-related requests

A a555 takes all privacy-related requests seriously. Every inquiry receives a tracking number for follow-up. If you are not satisfied with the response you receive, you have the right to contact the National Data Protection Authority (ANPD) through its official channels.