Privacy Policy dd44 — Data Protection and LGPD

The dd44 only collects the data necessary to operate the platform securely, process BRL payments, and meet legal obligations. Below, we detail each category of data collected and the reason for its collection:

Registration data:

• Full name, date of birth and CPF — for identity verification (KYC) and confirmation that the user is 18 or older;
• Email address — for authentication, platform communications, and password recovery;
• Mobile number — for two-factor authentication (2FA) and security notifications;
• Full residential address — for identity verification and compliance with Brazil's betting regulations.

Platform usage data:

• Sports betting history, including sports, markets, amounts, and outcomes — for account management and user reporting;
• Casino session history, including games accessed, session duration and amounts wagered — for support and responsible gambling monitoring;
• Deposit and withdrawal data — method used, amounts, dates and processing status;
• Access logs — IP address, device type, operating system, browser, and login time — for account security and detection of suspicious access.

Payment data: dd44 does not store full credit or debit card details. This information is processed directly by certified payment gateways. For Pix, we store only the Pix key and the account holder's name for withdrawal processing purposes. For boleto bancário, we record only the document number and settlement status.

Dd44 does not collect sensitive data — such as racial origin, religious beliefs, health information, or sexual orientation — at any stage of registration or platform use.

The dd44 processes your personal data based on specific, legitimate, and transparent purposes, always in compliance with the legal bases set out in the LGPD. Every piece of data collected has a clear reason to exist in our system.

The main purposes for which dd44 processes data are:

• Contract performance: process registration, authenticate access, settle bets, process deposits via Pix, boleto bancário, credit/debit card, Mercado Pago, and PicPay, and process withdrawals to the account holder's bank account;
• Legal obligation compliance: KYC identity verification as required by Sports Betting regulations, anti-money laundering (AML/CFT) compliance, and reporting to relevant authorities when required by law;
• Legitimate interest: fraud prevention, detection of multiple-account use, monitoring of betting behavior to identify signs of problem gambling, and security of the platform and other users;
• Consent: sending marketing communications, promotions and platform updates — you may withdraw this consent at any time through the dd44 account settings panel or via the unsubscribe link included in all promotional emails;
• Experience personalization: suggestions of sports markets, casino games, and promotions based on your platform usage history, making the experience more relevant to your betting profile.

Dd44 does not make automated decisions with significant impact on users without human review, except in cases of clear fraud detected automatically — in which case the user is notified and may contest the decision through the support channel.

The dd44 does not sell, rent, or otherwise trade users' personal data for third-party advertising purposes. Data sharing occurs only in the situations described below, each with an appropriate legal basis:

Essential operating partners:

• Payment processors: Pix gateways, card acquirers, Mercado Pago, and PicPay receive only the data strictly necessary to process the transaction (name, CPF, and payment key). All operate with PCI DSS certification and are bound by data protection agreements;
• Casino game providers: slots, live games and crash games providers receive an anonymous user identifier (no name or CPF) for technical integration and RNG audit purposes;
• KYC verification services: for CPF and identity document verification, we use Brazil-certified partners who operate under strict confidentiality and do not retain data beyond what is necessary for the verification;
• Cloud infrastructure providers: dd44's servers and databases operate in ISO 27001-certified data centers located in Brazil or in jurisdictions with an adequate level of data protection as assessed by the ANPD.

Authorities and legal obligations: dd44 may be required to share data with public authorities — such as the Federal Revenue Service, Central Bank, COAF, Public Prosecutor's Office or the Judiciary — when there is a valid legal, judicial or administrative order. In such cases, we share only the data specifically requested, within the applicable legal limits.

Any new partner that may eventually require access to dd44 user data will be assessed for LGPD compliance before integration, and this policy will be updated to reflect that sharing.

The dd44 uses cookies and similar technologies to ensure the platform works correctly, improve the user experience, and understand how the platform is being used. Below, we detail each category of cookie used:

To manage cookies in your browser, go to the privacy settings in Chrome, Firefox, Safari, or Edge and adjust permissions to your preference. In the dd44 mobile app, cookie preferences are available under Settings → Privacy. Disabling non-essential cookies may affect some personalization features, but will not prevent you from using the platform for betting and withdrawals.

Dd44 does not use third-party tracking pixels for external advertising purposes. No betting behavior data is shared with ad networks or external marketing platforms without the user's express consent.

The dd44 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by Brazilian law applicable to the betting and financial services sectors.

Retention periods by data category:

• Registration and identity data (CPF, name, address): retained for the duration of the active account and for a minimum of 5 years after closure, as required by anti-money laundering regulations (Lei nº 9.613/1998);
• Betting and financial transaction history: retained for a minimum of 5 years after each transaction, for regulatory audit and dispute resolution purposes;
• Access and security logs: retained for 6 months from the date of registration, and may be extended if an investigation is ongoing;
• Support communication data: retained for 2 years after the support ticket is closed, for record-keeping and quality purposes;
• Marketing consent data: retained while consent is active; deleted within 30 days of revocation.

Once retention periods expire, data is deleted or irreversibly anonymized. Data from accounts voluntarily closed by the user is deleted within the mandatory legal timeframes — the user will be notified by email once deletion is complete. If a judicial or administrative investigation is ongoing, related data may be retained until the proceedings conclude, regardless of standard retention periods.

User data security is one of the core priorities of the dd44. We continuously invest in technology and processes to minimize the risk of unauthorized access, data leaks, or misuse of personal information.

Technical measures in place:

• 256-bit SSL/TLS encryption on all communications between the user's device and dd44 servers;
• Passwords stored as cryptographic hashes using bcrypt algorithms with a unique salt per user — never in plain text;
• Two-factor authentication (2FA) available and encouraged for all accounts;
• Continuous monitoring of suspicious access attempts, including automatic blocking of IPs showing anomalous behavior;
• Segregation of production and development environments — real user data is never used in test environments;
• Encrypted backups with regular rotation and periodic recovery testing;
• Security audits conducted by specialized third parties at regular intervals.

Organizational measures: Access to users' personal data is restricted to dd44 staff who have an operational need for it, following the principle of least privilege. All staff with access to personal data undergo information security training and sign confidentiality agreements. In the event of a security incident with potential impact on data subjects, dd44 will notify affected users and the National Data Protection Authority (ANPD) within the timeframes set out by the LGPD.

Despite all these precautions, no system is 100% impenetrable. Users also share responsibility for their account's security: use strong, unique passwords, enable 2FA, never share your credentials, and contact support immediately if you notice any suspicious activity on your dd44 account.

The LGPD grants you, as a data subject, a set of rights that dd44 is committed to respecting and facilitating. You may exercise any of these rights by contacting support at suporte@dd44.world or via the platform's live chat. Responses are provided within up to 15 calendar days of receiving the request.

The dd44 may update this Privacy Policy periodically to reflect changes in our services, applicable legislation, or our data processing practices. Whenever there are material changes, we will notify users by registered email and/or through a prominent notice on the platform, at least 7 days before the new terms take effect.

The most up-to-date version of this Policy will always be available on this page, with the last updated date displayed at the top. We recommend reviewing it periodically to stay informed about how your data is handled at dd44.

Continued use of the dd44 platform after an updated version of this Policy takes effect constitutes acceptance of the new terms. If you do not agree with the changes, you may request account closure and deletion of your data before the new terms come into effect, at no cost.

For questions, LGPD rights requests, or privacy-related complaints, please contact our data protection officer (DPO) at suporte@dd44.world, identifying your request as "LGPD — [request type]" in the subject line.

This Privacy Policy is governed by the laws of the Federative Republic of Brazil, in particular Lei nº 13.709/2018 (LGPD) and the regulations of the National Data Protection Authority (ANPD).