Privacy Policy of 4win — Your Data Protected by the LGPD

A 4win is the controller of the personal data processed under this policy, operating the Sports Betting and online casino platform available at 4win.life. 4win acts as a data controller as defined by art. 5, item VI of the LGPD — meaning it is the company that makes decisions about how and for what purposes your data is used.

4win operates in compliance with Brazilian fixed-odds sports betting legislation (Law No. 14,790/2023), the regulations of the Ministry of Finance, and the General Personal Data Protection Law (LGPD — Law No. 13,709/2018).

For data protection matters, the official contact is privacidade@4win.life. For general account support, please use suporte@4win.life or the live chat on the platform.

4win collects personal data across the following categories:

Registration and identification data:

• Full name;
• CPF (Individual Taxpayer Registry);
• Date of birth;
• Email address;
• Brazilian mobile number;
• Full residential address (including ZIP code).

Identity verification data (KYC):

• Official photo ID document (national ID, driver's license, or passport);
• Proof of residence issued within the last 3 months;
• Selfie with ID document (when requested by the verification system);
• Bank account ownership document or Pix key proof.

Financial and transaction data:

• Pix key associated with the account;
• Deposit and withdrawal history (amounts, dates, methods);
• Credit or debit card details (processed via tokenization — 4win does not store the full card number).

Platform usage data:

• Complete betting history (amount, market, outcome);
• Casino and crash game session history;
• Game preferences and account settings.

Technical access data:

• IP address at the time of access;
• Device type (mobile, tablet, computer);
• Operating system and browser version;
• Approximate geolocation (city/state, derived from IP);
• Cookies and session identifiers (detailed in section 10).

4win collects personal data through the following methods:

• Directly from you: during registration on the platform, during the identity verification (KYC) process, when making a deposit or withdrawal, when configuring account preferences, and when contacting support;
• Automatically during use: when browsing the platform, placing bets, playing at the casino, or accessing crash games, technical data such as IP address, device, session duration, and interactions are automatically recorded by 4win's servers;
• Through cookies and similar technologies: as detailed in section 10 of this policy;
• From external sources for verification: during the KYC process, 4win may consult public databases or authorized third-party sources to verify the authenticity of documents and prevent fraud.

4win does not collect data from social media profiles without your explicit consent, nor does it purchase personal data lists from third parties for prospecting purposes.

Each piece of data collected by 4win has a specific, documented purpose. The table below summarizes the main purposes:

4win does not use personal data to build behavioral profiles for sale to third parties, nor for purposes incompatible with those described above without prior notice and, where required, renewed consent.

The LGPD requires that each data processing activity have a legal basis provided by law. At 4win, the legal bases used are:

• Contract performance (Art. 7, V): processing required to create and maintain your account, handle bets, deposits and withdrawals, and deliver the services you agreed to when accepting the Terms and Conditions;
• Compliance with a legal or regulatory obligation (art. 7, II): identity verification (KYC), anti-money laundering compliance, reports required by betting sector regulatory authorities and the Federal Revenue Service;
• Consent (art. 7, I): sending marketing communications via email, SMS, or push notifications about promotions, new games, and special events. You can withdraw this consent at any time through your account dashboard or by emailing privacidade@4win.life;
• Legitimate interest (Art. 7, IX): platform improvement based on aggregated usage data, security analysis, and fraud prevention, provided these do not override your fundamental rights and freedoms.

4win does not sell, rent, or transfer users' personal data to third parties for commercial purposes. Data is shared only in the following situations, all of which are necessary for the platform's operation:

• Payment processors: to process deposits and withdrawals via Pix, credit/debit card, boleto bancário, PicPay, and Mercado Pago. These partners receive only the data strictly necessary for each specific transaction and operate under confidentiality and data protection agreements;
• Casino game providers: such as Evolution Gaming, Pragmatic Play, and PG Soft, for the operation of live tables and slots. These providers receive anonymized session identifiers, not full identity data;
• Identity verification (KYC) platforms: to process the validation of submitted documents. These partners are certified and operate under legislation compatible with the LGPD;
• Public and regulatory authorities: when required by court order, regulatory directive from the Ministry of Finance, ANPD, Federal Revenue Service, or another competent authority, within the limits of the law;
• Companies within the same corporate group: for administrative management, compliance, and internal audit purposes, always under the same data protection conditions set out in this policy.

All third parties that process personal data on behalf of 4win are contractually required to handle such data exclusively in accordance with 4win's instructions, maintain confidentiality, and implement appropriate technical and organizational security measures.

Some of 4win's technology partners and game providers operate servers located outside Brazil. When personal data is transferred internationally — for example, to process a live casino session with a European provider — 4win applies the safeguards required under the LGPD:

• Transfer only to countries with an adequate level of protection recognized by the ANPD, or;
• Adoption of standard data protection contractual clauses between 4win and the receiving partner, or;
• Obtaining the data subject's specific consent for the transfer, where none of the other options apply.

Complete identity data (CPF, identity document, proof of address) is stored primarily on servers located in Brazil. Technical session and game data may be processed on servers abroad as described above.

4win implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, loss, alteration, disclosure, or destruction. The main measures in place include:

• 256-bit SSL Encryption: all data transmitted between your device and 4win's servers is encrypted in transit;
• Encryption at rest: sensitive data stored on 4win's servers, such as CPF, banking details, and identity documents, is stored in encrypted form;
• Two-factor authentication (2FA): available to all users in account settings — 4win strongly recommends enabling it;
• Internal access controls: only 4win employees with a proven need for their role are granted access to users' personal data, and all such access is recorded in audit logs;
• Continuous monitoring: automated systems for detecting intrusions, anomalous behavior, and unauthorized access attempts operate around the clock on 4win's servers;
• Periodic security testing: 4win conducts regular penetration testing and security audits with specialized third-party firms.

No security system is 100% breach-proof. In the event of a security incident that compromises personal data, 4win will notify the ANPD and affected users within the timeframes established by the LGPD, detailing the nature of the incident and the measures taken to mitigate it.

4win retains personal data for as long as necessary to fulfill the purposes for which it was collected, also taking into account applicable legal and regulatory obligations. General retention periods are:

• Registration and KYC data: retained for the entire duration of the account and for 5 years after closure, in accordance with anti-money laundering obligations (Law No. 9,613/1998);
• Financial transaction history: maintained by 5 years after the transaction, in accordance with tax and regulatory obligations;
• Betting history: maintained by 5 years after completion, for regulatory compliance purposes and defense in potential disputes;
• Technical access data (logs): retained for 6 months, unless required for an ongoing investigation;
• Support communications: maintained by 2 years after the support session is closed.

Once retention periods expire, data is securely deleted or anonymized. Anonymization is an alternative to deletion when the data still holds value for statistical analysis and platform improvement — in that case, the anonymized data can no longer be used to identify the user and is no longer considered personal data.

If you request the deletion of your data before the legal retention periods expire, 4win will delete everything that can be immediately deleted and retain only what is strictly necessary to meet legal obligations, with clear information on what was kept and why.

4win uses cookies and similar technologies to ensure the platform functions properly and to improve the user experience. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — such as keeping your session active after login, preserving items in your bet slip, and securing transactions. These cannot be disabled without affecting platform functionality;
• Performance and analytics cookies: collect aggregated and anonymized data on how users navigate the platform — which pages are visited most, average session duration, errors encountered. Used exclusively to improve 4win. Can be disabled without affecting core functionality;
• Preference cookies: store settings you have chosen, such as preferred language, selected layout, and favorite games. Disabling them may cause these preferences not to be remembered between sessions.

4win does not use tracking cookies for third-party advertising purposes. There is no integration with ad networks that track your behavior across other sites to serve targeted advertising.

You can manage your cookie preferences through the banner displayed on your first visit to the platform or through your browser settings. Removing all cookies may require you to log in again and reconfigure any previously saved preferences.

4win services are intended exclusively for individuals aged 18 years of age or older. 4win does not intentionally collect personal data from individuals under 18 years of age.

If, for any reason, data belonging to a minor comes to 4win's attention — whether through incorrect information provided during registration or through communication from a legal guardian — the platform will immediately take the following steps:

• Immediate suspension of any account identified as belonging to a minor;
• Deletion of all personal data collected, except for data required to document the incident as mandated by law;
• Refund of any deposits made, following verification and in accordance with the standard return procedure;
• Notification to the identified legal guardian, where applicable.

To exercise any right under the LGPD — access, correction, deletion, portability, objection, or withdrawal of consent — you may use the following channels:

• 4win account dashboard: go to "Settings > Privacy" to manage consents, export basic data, and request account deletion;
• Data Protection Officer email: privacidade@4win.life — for complete data access requests, portability, deletion with specific justification, or complaints regarding data processing;
• Live chat: for general privacy questions and guidance on how to submit a specific request.

When submitting a request by email, please include:

• Your full name and the email address registered with 4win;
• The right you wish to exercise (access, correction, deletion, etc.);
• Specific details of the request (for example: which data you want to access, which information you want to correct).

4win will respond within 15 business days. If the request is complex or involves a large volume of data, this deadline may be extended by an equal period, with prior notice to the requester. 4win may request identity verification before processing sensitive requests to ensure data is provided only to the rightful account holder.

As required by the LGPD, 4win has appointed a Data Protection Officer (also known as DPO — Data Protection Officer). The DPO serves as the communication channel between 4win, data subjects, and the National Data Protection Authority (ANPD).

The data protection officer's responsibilities include:

• Receive complaints and communications from data subjects and the ANPD;
• Train 4win staff on data protection practices;
• Carry out any other duties assigned by the controller or established in supplementary regulations;
• Continuously monitor 4win's compliance with the LGPD.

Contact 4win's Data Protection Officer:

• Email: privacidade@4win.life
• Suggested subject: "LGPD Request — [brief description]"

All communications addressed to the DPO are treated confidentially and answered within the statutory deadline.

4win may update this Privacy Policy periodically to reflect changes in Brazilian legislation, sports betting regulations, the company's operational practices, or decisions issued by the ANPD.

When changes are significant — such as updates to processing purposes, the data collected, or users' rights — 4win will notify users at least 15 days' notice via registered email and through a prominent notice on the platform.

Minor formal changes — such as editorial corrections or updated contact details — may be made without prior notice, but will always be reflected in the "last updated" date shown at the top of this page.

Continued use of 4win's services after a new version of this policy takes effect constitutes acceptance of the changes made. If you do not agree with the changes, you may close your account before the effective date and request deletion of your data as described in section 12.

For any questions relating to this Privacy Policy, the processing of your personal data by 4win, or the exercise of your rights as a data subject, please use the channels below:

• Data protection officer (DPO) / LGPD inquiries: privacidade@4win.life
• General support / account inquiries: suporte@4win.life
• Live chat: available on the platform after login, 24 hours a day, 7 days a week

If you believe 4win has handled your data improperly and have not received a satisfactory response through the channels above, you have the right to file a complaint directly with the National Data Protection Authority (ANPD), through the official federal government portal.