22ll Privacy Policy – Your Data Protected

1Introduction

The 22ll makes the protection of its players' personal data a top priority. This Privacy Policy was developed in compliance with the General Personal Data Protection Law (LGPD, Law No. 13,709/2018) and transparently explains how we handle information collected during your use of the Sports Betting and online casino platform.

When you create an account on the 22ll, makes a deposit via Pix, bets on a Brasileirão football match, or plays at a live roulette table, some information is processed to ensure the service works correctly. This document details what that information is, why we collect it, and what we do with it.

The 22ll acts as the controller of the personal data processed under this policy and is responsible for decisions regarding the processing of that information. Our Data Protection Officer (DPO) can be reached at privacidade@22ll.best for any questions related to personal data processing.

2Data We Collect

2.1 Data You Provide Directly

At the time of registration and throughout your use of the platform, the 22ll collects the following information that you provide directly:

• Full name;
• CPF (Cadastro de Pessoa Física);
• Date of birth;
• Email address;
• Mobile phone number (when provided);
• Residential address (when requested for verification);
• Identity document details (national ID, driver's license) submitted during the KYC verification process;
• Pix key details for withdrawal processing;
• Credit or debit card details (processed through a secure gateway and not stored in plain text by 22ll).

2.2 Automatically collected data

When you browse the 22ll, technical systems automatically collect:

• IP address and approximate location information;
• Device type, operating system, and browser used;
• Pages visited, time spent, and interactions with the platform;
• Cookie identifiers and similar technology identifiers;
• Records of bets placed, games accessed, and financial transactions;
• Access logs with date, time, and session duration.

2.3 Third-party data

In some cases, 22ll may receive information about you from third parties such as identity verification providers, payment processors including Pix, PicPay, and Mercado Pago, and fraud prevention systems. This information is used solely to verify your identity, process transactions, and protect the integrity of the platform.

2.4 Summary table of data collected

3How We Use Your Data

The personal data collected by 22ll are used for the following purposes:

• Service operation: create and manage your account, process deposits via Pix, boleto, and card, and calculate and pay out winnings from Sports Betting and Live Casino games;
• Identity verification: confirm that you are 18 or older, validate documents during the KYC process, and fulfill legal verification obligations;
• Fraud prevention: detect and prevent suspicious activity, multiple accounts, money laundering, and other behavior that violates the platform's Terms and Conditions;
• Operational communications: send deposit confirmations, withdrawal notifications, security alerts, and important account updates;
• Marketing communications: send promotions, bonus information, slots tournaments, and platform updates, only when you consent to this type of communication;
• Personalization: tailor your platform experience based on your betting history and gaming preferences, such as highlighting the sports and markets you follow most often;
• Responsible gambling: monitor gaming patterns to identify signs of problem gambling and, when necessary, reach out to the player with information about available responsible gaming tools;
• Service improvement: analyze aggregated and anonymized platform usage data to improve features, fix bugs, and develop new functionality;
• Legal compliance: comply with regulatory requirements, court orders, and requests from competent authorities in Brazil.

4Legal Basis for Processing

The 22ll processes your personal data based on the following legal grounds established by the LGPD:

• Contract performance (art. 7, V): processing is necessary to perform the service you agreed to when registering on the platform, including bet processing, payments, and account management;
• Compliance with a legal obligation (Art. 7, II): certain processing activities are required by law, such as identity verification, anti-money laundering measures, and reporting to regulatory authorities;
• Legitimate interest (Art. 7, IX): fraud prevention, platform security, service improvement, and behavioral analysis to enhance the player experience;
• Consent (Art. 7, I): for marketing communications, sending personalized promotions, and the use of non-essential cookies. You may withdraw consent at any time without affecting your access to the platform's essential services.

5Data Sharing

5.1 Who We Share Data With

The 22ll does not sell players' personal data to third parties. Data sharing occurs only in the following cases and with the following categories of recipients:

• Game providers: Evolution Gaming, Pragmatic Play, PG Soft, and other content providers receive anonymized identifiers required for the operation of live tables and slots. These providers operate under their own privacy policies and are contractually obligated to protect the data shared with them;
• Payment processors: to process deposits and withdrawals via Pix, boleto bancário, credit and debit cards, PicPay, and Mercado Pago, the information required to complete each transaction is shared with the respective payment processors;
• Identity verification services: specialized third-party KYC providers receive identity documents and information for validation purposes, operating under data processing agreements with 22ll;
• Competent authorities: data may be shared with regulatory bodies, law enforcement, and judicial authorities when required by law, court order, or legitimate investigation;
• Auditors and consultants: auditing professionals, legal counsel, and technical consultants who need to access data in the course of their duties, always under confidentiality obligations.

5.2 What we never do

• Selling your data to advertising networks or data brokers;
• Share your betting history with employers, insurers, or credit institutions;
• Disclosing your financial information to third parties without a legal basis and a data protection agreement;
• Use your data for purposes incompatible with those described in this policy without prior notice and, where applicable, renewed consent.

6Data Retention

The 22ll retains your personal data for as long as necessary to fulfill the purposes for which it was collected, or for periods required by law. The general retention criteria are:

• Active account data: for as long as the account remains active and for the period required after closure to fulfill legal obligations;
• Financial records: deposit and withdrawal transactions are retained for a minimum of 5 years in compliance with applicable Brazilian tax and anti-money laundering legislation;
• KYC verification data: identity documents are retained for the legally required period, generally a minimum of 5 years after account closure;
• Bet logs: the history of Sports Betting, slots, roulette, and other games is retained in accordance with regulatory requirements and for the resolution of any disputes;
• Marketing data: retained until consent is withdrawn or for 2 years of inactivity, whichever comes first.

After the applicable retention period, data is securely deleted or anonymized so that it no longer allows identification of the data subject.

7Information Security

The 22ll implements appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, improper alteration, or disclosure. These measures include:

• 256-bit SSL Encryption across all communication between your device and the platform's servers;
• Secure storage of passwords using hashing and salting techniques, preventing 22ll from accessing your password in plain text;
• Two-factor authentication (2FA) available to all players as an additional layer of login security;
• Anti-fraud system which monitors transactions and access in real time to identify suspicious patterns;
• Internal access control restricting which 22ll employees can access personal data and under what conditions;
• Security audits periodic audits conducted by internal teams and independent laboratories;
• Incident response plan for swift action in the event of a suspected data breach, including notification to the ANPD and affected data subjects as required by the LGPD.

8Cookies & Similar Technologies

8.1 What are cookies

Cookies are small text files stored on your device when you access the 22ll. They allow the platform to remember your preferences, keep your session active after login, and collect information about how you use the site.

8.2 Types of cookies we use

• Essential cookies: required for the basic operation of the platform, such as keeping your session logged in and processing bets. They cannot be disabled without compromising the functionality of the service;
• Performance cookies: collect information on how players use the platform (pages visited, load times, errors) so that the 22ll can improve the experience. Information is aggregated and does not identify players individually;
• Preference cookies: remember your language settings, game preferences, and other customizations so you don't have to reconfigure them every time you log in;
• Analytics cookies: used to understand general platform usage patterns and measure the effectiveness of implemented improvements.

8.3 Managing Cookies

You can manage and disable non-essential cookies through your browser settings (Chrome, Safari, Firefox, or others). Disabling essential cookies may prevent certain features from working correctly, including login, live betting, and Pix payment processing.

9Your Rights as a Data Subject

The LGPD grants you, as a data subject, the following rights, which may be exercised with the 22ll:

10Minors

The platform of 22ll is intended exclusively for individuals aged 18 and over. The 22ll does not intentionally collect personal data from minors. If a user under 18 attempts to register on the platform, any information provided will be deleted as soon as the irregularity is identified.

If you are the guardian of a minor and believe they may have registered on the 22ll, please contact support immediately in Portuguese via live chat or at privacidade@22ll.best so we can take the appropriate steps, including deleting all data and closing the account.

The 22ll maintains age verification systems during registration and KYC specifically to ensure the platform is not accessed by anyone under 18.

11International Data Transfer

Due to partnerships with game providers such as Evolution Gaming and Pragmatic Play, which operate servers in different countries, some data may be transferred outside Brazil in the normal course of operations. When this occurs, the 22ll ensures that:

• The transfer is made to countries with a level of data protection adequate or equivalent to that of the LGPD;
• Specific data protection contractual clauses are included in contracts with recipient vendors;
• Data transferred is limited to the minimum necessary for the performance of the contracted service;
• Vendors are contractually prohibited from using the data for any purpose beyond what is necessary to provide services to 22ll.

12Changes to the Privacy Policy

The 22ll may update this Privacy Policy periodically to reflect changes in data processing practices, legal requirements, or platform improvements. When changes are significant, you will be notified by email or through a prominent notice on the platform before the changes take effect.

The "Last updated" date at the top of this page indicates when the current version was published. We recommend reviewing this policy periodically to stay informed about how the 22ll protects your personal data.

Continued use of the platform after significant changes take effect constitutes acceptance of the new terms. If you do not agree with the changes, you may close your account and request deletion of your data as described in the data subject rights section.

13Contact & Data Protection Officer

The 22ll has appointed a Data Protection Officer (DPO) responsible for overseeing privacy practices and serving as the point of contact for matters related to personal data processing. You can reach them through the channel below:

• DPO email: privacidade@22ll.best
• General email: contato@22ll.best
• Live chat: available every day in Portuguese, accessible through the platform after login

You also have the right to file a complaint with the National Data Protection Authority (ANPD) if you believe that the processing of your data by the 22ll violates the LGPD. The ANPD's contact information is available on the authority's official website.

We are committed to responding to privacy-related requests within 15 business days of receipt. In cases that require deeper analysis, we may extend this timeframe with justification, as permitted under the LGPD.