Privacy Policy sp111 – Data Protection & LGPD

Sp111, accessible at https://sp111.click, is the controller of the personal data processed under this policy. The controller is the entity that determines the purposes and means of processing users' personal data on the platform.

For privacy and data processing concerns, the official contact channel is:

• Email for LGPD requests: suporte@sp111.click (subject: "LGPD Request")
• General support: live chat available 24/7 in Portuguese
• Response time for LGPD requests: up to 15 business days

This Privacy Policy applies to all services offered by sp111, including the main website, associated mobile apps, and any other interface used to access the platform.

Sp111 collects personal data at various points during your interaction with the platform. Collection is always proportionate and limited to what is necessary for the purposes described in this policy.

Data you provide directly:

• Full name, CPF, date of birth, and residential address in Brazil — provided during registration and used for identification and legal verification.
• Email address and mobile number — used for communications, authentication, and account recovery.
• Identity documents (national ID, driver's license, passport) and proof of address — provided during the mandatory KYC verification process required for withdrawals.
• Payment data, such as the Pix key linked to the CPF, and credit or debit card details processed by certified gateways — used exclusively to process deposits and withdrawals.
• Information provided to our support team during chat or email interactions.

Data collected automatically during platform use:

• IP address, approximate IP-based location, device type, operating system, and browser — used for account security and detection of unauthorized access.
• Betting history, games accessed, amounts wagered and won — used for support, fraud detection, responsible gambling, and mandatory financial reporting.
• Session times and durations on the platform — used for responsible gambling alerts and abnormal behavior analysis.
• Cookies and similar technologies — described in detail in Section 6 of this policy.

Personal data collected by sp111 is used exclusively for the following purposes:

• Account creation and management: Registration, authentication, account settings, and access recovery.
• Identity verification (KYC): Verification of the account holder's identity prior to withdrawal processing, in accordance with regulatory anti-money laundering requirements.
• Payment processing: Processing deposits via Pix, boleto bancário, credit and debit card, PicPay, Mercado Pago, or TED, and handling withdrawal requests.
• Service provision: Proper operation of Sports Betting (Brasileirão, Libertadores, Copa do Brasil), Live Casino, slots, crash games, and E-sports.
• Security and fraud prevention: Multiple account detection, analysis of suspicious betting patterns, anti-money laundering, and protection against unauthorized access.
• Responsible gambling: Behavioral pattern monitoring for automatic alerts, management of user-configured limits, and administration of self-exclusions.
• Customer support: Troubleshooting, complaint handling, and communications required for account maintenance.
• Compliance with legal obligations: Reports to COAF (Financial Activities Control Council) and other competent authorities as required by Brazilian law.
• Marketing communications: Sending promotions, news, and offers — only to users who have given consent, always with an easy opt-out option.

Sp111 does not use users' personal data to build profiles for sale to third parties, for behavioral advertising outside the platform, or for any purpose not listed above.

The Lei Geral de Proteção de Dados (LGPD — Law 13.709/2018) requires that all personal data processing have a valid legal basis. sp111 processes personal data based on the following legal grounds established in Article 7 of the LGPD:

• Contract performance (Art. 7, V): Processing necessary to provide the services contracted by the user — account creation, betting, payments, and withdrawals.
• Compliance with a legal obligation (Art. 7, II): Processing required under Brazilian law, including anti-money laundering regulations (Law 9.613/98), Central Bank rules, and COAF requirements.
• Legitimate interest (Art. 7, IX): Processing for platform security, fraud detection, and service improvement purposes, where the data subject's interests or fundamental rights do not override such purposes.
• Consent (Art. 7, I): For processing not covered by the legal bases above — such as sending marketing communications — sp111 requests explicit consent and provides a simple opt-out mechanism that can be used at any time.

Sp111 does not sell, rent, or share users' personal data with third parties for commercial or advertising purposes. Data sharing occurs only in the following situations, always with a specific purpose and appropriate contractual safeguards:

• Payment processors: Financial data is shared with PCI-DSS certified payment gateways to process deposits via Pix, boleto, credit and debit card, PicPay, Mercado Pago, and TED. These partners are contractually prohibited from using the data for any other purpose.
• Identity verification providers: Documents submitted for KYC may be processed by specialized verification partners, always under confidentiality agreements and strictly limited to verification purposes.
• Game providers: Minimal session data is shared with game providers such as Pragmatic Play and Evolution Gaming for the technical operation of games. These partners receive no personally identifiable data beyond an anonymous session identifier.
• Regulatory authorities and law enforcement: Data is shared with COAF, the Federal Revenue Service, the Central Bank, or other competent authorities when required by law, court order, or applicable regulation.
• Technical service providers: Hosting, cybersecurity, and technical analytics partners who access data as part of providing services to sp111, always under LGPD-compliant data processing agreements.

In all sharing scenarios, sp111 requires recipients to maintain security and confidentiality standards consistent with those described in this policy and with the LGPD.

Sp111 uses cookies and similar technologies to ensure the platform operates correctly, improve the user experience, and maintain session security. When you access the platform, you will be informed about the use of cookies and can manage your preferences.

Types of cookies used:

• Essential cookies: Required for the platform's core functions — authentication, session management, and security tools. These cannot be disabled without impairing your use of the platform.
• Preference cookies: Store user settings such as language, display preferences, and accessibility configurations. Can be disabled in your browser settings.
• Analytics cookies: Used to understand how users navigate the platform and identify areas for improvement. Data is aggregated and anonymized. Can be declined in the cookie consent banner.
• Security cookies: They detect suspicious behavior such as multiple logins, unauthorized access attempts, and abnormal usage patterns. Essential for account protection.

Sp111 does not use third-party cookies for behavioral advertising purposes outside the platform. Social media tracking pixels are not installed on sp111 pages without explicit consent.

Sp111 retains personal data for as long as necessary to fulfill the purposes for which it was collected, always observing the minimum retention periods required by Brazilian law.

• Identification data and KYC documents: Retained for a minimum of 5 years after account closure, in accordance with anti-money laundering legislation (Law 9.613/98) and Banco Central regulations.
• Financial transaction history: Retained for a minimum of 5 years for regulatory audit purposes and potential disputes. The period may be extended in the event of an active investigation.
• Betting and gaming history: Retained for 2 years for support, dispute resolution, and responsible gaming analysis. After this period, data is anonymized.
• Support communications: Retained for 2 years for dispute resolution and ongoing service improvement.
• Consent-based marketing data: Retained until consent is withdrawn by the user. Following withdrawal, data is deleted within 30 days.
• Technical data (logs, IPs): Retained for 6 months for security and technical diagnostic purposes, except for logs related to active security investigations.

Once the applicable retention periods expire, data is securely and irreversibly deleted or anonymized for use in aggregate analysis with no individual identification.

Sp111 implements appropriate technical and organizational measures to protect users' personal data against unauthorized access, accidental loss, improper alteration, or disclosure. Key security measures include:

• Encryption in transit: All communications between the user's device and sp111's servers are encrypted using TLS protocol and 256-bit SSL certificates.
• Encryption at rest: Sensitive data stored on servers — including KYC documents and financial data — is encrypted at rest using AES-256 standards.
• Hashed passwords: User passwords are stored exclusively as irreversible bcrypt hashes. Not even sp111's technical team has access to the original passwords.
• Two-factor authentication (2FA): Available to all users and strongly recommended for account access and withdrawal requests.
• Internal access controls: Access to users' personal data is restricted to sp111 employees with a legitimate business need, under a least-privilege policy and with audit logging.
• Continuous monitoring: Intrusion detection systems and abnormal behavior analysis operate 24/7 to identify threats in real time.
• Regular security testing: sp111 conducts periodic penetration tests carried out by independent security teams.

Some of sp111's technical partners operate servers outside Brazil — such as cloud infrastructure providers and certain game suppliers with global operations. When personal data is transferred outside Brazilian territory, sp111 ensures that such transfers are carried out with the appropriate safeguards required by the LGPD.

Safeguards adopted for international transfers include:

• Data processing agreements with protection clauses equivalent to those of the LGPD, using internationally recognized standard models.
• Preference for partners holding international security certifications such as ISO 27001, SOC 2, and PCI-DSS.
• Only the data strictly necessary for the specific purpose is transferred, with no unnecessary replication of personal information.

Data used for payments via Pix, boleto, credit and debit card, PicPay, Mercado Pago, and TED are processed by partners operating in Brazil or with infrastructure compliant with Banco Central do Brasil requirements.

Sp111 is a platform exclusively for users aged 18 and over. We do not intentionally collect personal data from anyone under 18.

By creating an account, the user declares they are at least 18 years of age. The identity verification (KYC) process includes confirming the date of birth through official documents.

If sp111 identifies that an account was created by a person under the age of 18, the following measures will be taken immediately:

• Immediate account closure.
• Full refund of all deposits returned to the original payment method, with no deductions.
• Deletion of all collected personal data, except what is necessary to document the account closure and prevent re-registration using the same CPF.

If you suspect a minor has created an account on sp111 using false information, contact support immediately so we can take prompt action.

To exercise any of your rights as a personal data subject, follow the procedure below:

1. Send an email to suporte@sp111.click with the subject line in the following format: "LGPD Request – [request type]". Examples: "LGPD Request – Access to My Data" or "LGPD Request – Data Deletion".
2. Include in the body of the email: your full name, CPF registered with sp111, request type, and, where applicable, a specific description of the data or processing activities in question.
3. Wait for the payment confirmation which will be sent within 2 business days confirming that your request has been received and providing a reference number.
4. Receive your response within 15 business days with the requested information or the legal justification if the request cannot be fulfilled.

If you are not satisfied with sp111's response, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD) through the authority's official website. sp111 cooperates fully with the ANPD in any investigations that may be initiated.

The LGPD requires organizations that carry out large-scale data processing to appoint a Data Protection Officer (DPO), who serves as the communication channel between the company, data subjects, and the Autoridade Nacional de Proteção de Dados.

Sp111's Data Protection Officer can be reached exclusively by email suporte@sp111.click, with the subject "DPO sp111 – [subject]". This channel is used for:

• Handling data subject requests related to the exercise of rights under the LGPD.
• Receipt of communications from the ANPD.
• Clarifications on data processing practices and this Privacy Policy.
• Notifications of potential security incidents involving sp111 personal data.

The Data Protection Officer works closely with sp111's compliance, legal, and technology teams to ensure ongoing adherence to the LGPD and data protection best practices.

Sp111 may update this Privacy Policy periodically to reflect changes in data processing practices, new legal requirements, or improvements to our services. Material changes will be communicated as follows:

• Significant changes: Communicated by email to all active users at least 30 days before taking effect, with the modified points clearly highlighted.
• Minor changes: Such as text corrections or contact updates, these may be made without prior notice. The update date at the top of this document will always reflect the latest change.

The most current version of this Privacy Policy is always available on this page. Continued use of the sp111 platform after a new version takes effect constitutes acceptance of the changes.

If you disagree with any material change, you may close your account before the new version takes effect, without penalty, and your available real balance will be returned in full. For more information on account closure, please refer to our Terms and Conditions.