99hi Privacy Policy – How We Protect Your Personal Data

99hi is a digital entertainment platform built for Brazilian users. To operate safely, legally, and efficiently, we need to collect and process certain personal data from our users. We do so responsibly, transparently, and with full respect for the rights of everyone who trusts our platform.

This policy was written to actually be read — not to be a technical document that no one understands. If after reading it you still have questions about any point, reach out to our team at suporte@99hi.best. We respond in Portuguese within a maximum of 2 business days for privacy-related matters.

The data controller responsible for processing your personal data is the company operating the 99hi platform, identified by the domain 99hi.best. The Data Protection Officer (DPO) can be reached by email at suporte@99hi.best with the subject line "LGPD – DPO".

As data controller, 99hi determines the purposes and means of processing the personal data collected on the platform. All processing activities have a legal basis under the LGPD and a defined purpose that is declared and communicated to the data subject before or at the time of collection.

99hi collects personal data at different points during your interaction with the platform. Below are the main types of data collected and when they are requested:

Data you provide directly:

• Full name — collected at registration, required for identification and KYC verification
• CPF — collected at registration, required for regulatory compliance and fraud prevention
• Date of birth — collected at registration for age verification (18+)
• Email address — collected at registration, used for account communications and password recovery
• Mobile number — collected at registration, used for two-factor authentication and communications
• Residential address — requested during identity verification, required for regulatory compliance
• Identity documents (RG, CNH, or passport) — requested during KYC verification for withdrawals above a certain amount
• Pix key — provided at the time of withdrawal, used exclusively to process the transfer

Data collected automatically during use:

• IP address and approximate geographic location — for suspicious access detection and geographic compliance
• Browser type and version and operating system — used to optimize your experience on the platform
• Pages visited, session duration, and browsing patterns — used for usability improvements and anomalous behavior detection
• Betting history, deposits, and withdrawals — required for transaction processing, financial reconciliation, and support
• Access logs with date and time — for security purposes and incident investigation

Every piece of data we collect has a specific, declared purpose that is proportional to the needs of the service. 99hi does not use personal data for purposes other than those stated in this policy without your explicit consent. The main purposes are:

99hi may also use aggregated and anonymized data — meaning data with no individual identifiers — for platform performance analysis, market research, and service improvement. Anonymized data is not considered personal data under the LGPD and may be processed without purpose restrictions.

All personal data processing carried out by 99hi is grounded in at least one of the legal bases set out in Article 7 of the LGPD. The bases used by the platform are:

• Contract performance — processing required to create and maintain your account, handle deposits and withdrawals, record bets, and provide the contracted services
• Compliance with a legal or regulatory obligation — processing required by Brazilian law, including anti-money laundering regulations, consumer protection rules, and gaming sector regulations
• Legitimate interest — processed to prevent fraud, secure the platform, detect unauthorized access, and improve services, provided this does not infringe on your fundamental rights
• Consent — processed for marketing communications, newsletters, and personalized offers, always with the option to withdraw consent at any time

99hi does not sell or share users' personal data with third parties for advertising or commercial purposes. Data sharing occurs only in the situations listed below, each with a specific and proportionate purpose:

• Payment providers — Pix (via the Brazilian banking system), credit/debit card processors, PicPay, and Mercado Pago receive only the data required to process the transaction (amount, Pix key, or card details). These partners are contractually bound to confidentiality and may not use your data for any other purpose
• Game providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Playtech, and other providers receive an anonymized session identifier to record game results. No personally identifiable data is shared with game providers
• Competent authorities — 99hi may share data with Brazilian judicial, law enforcement, or regulatory authorities when required by law, court order, or official investigation. In such cases, we share only the minimum necessary and, where legally permitted, notify the data subject
• Technology service providers — companies providing technical infrastructure (servers, cybersecurity, fraud analysis) access data only to the extent necessary to deliver the service and are bound by data processing agreements that include confidentiality and LGPD compliance clauses

Personal data from 99hi users is stored on servers with the following security features:

• Encryption at rest (AES-256) for all sensitive stored data
• Encryption in transit (TLS 1.3 / SSL 256-bit) for all communications between devices and servers
• Role-based access control (RBAC) — only team members with a documented operational need have access to personal data
• Personal data access logs recording who accessed the data, when, and for what purpose
• Encrypted backups with redundant storage
• Penetration testing and security audits conducted periodically by specialized firms
• A documented and tested incident response plan, including notification procedures for the ANPD and affected data subjects

Despite all security measures in place, no system is 100% immune to incidents. In the event of a data breach that could pose a significant risk to data subjects, 99hi will fulfill the notification obligations set out in the LGPD within 2 business days of becoming aware of the incident.

99hi retains personal data only for as long as necessary to fulfill the purposes stated in this policy or to meet legal obligations. General retention periods are:

• Registration and identification data: for as long as the account is active and for up to 5 years after closure, in accordance with AML requirements and financial regulations
• Financial transaction history (deposits, withdrawals): minimum of 5 years in accordance with Brazilian tax and regulatory legislation
• Betting history: 2 years from the date the bet was placed
• Access and security logs: 6 months, extendable if an investigation is ongoing
• Support and communication data: 2 years after the support ticket is closed

After the account is closed and all legal retention periods have been met, personal data is securely deleted or anonymized so that the data subject can no longer be identified.

99hi uses cookies and similar technologies to ensure the platform functions correctly, enhance the user experience, and detect fraudulent activity. The types of cookies used are:

• Essential cookies — required for the basic operation of the platform, including maintaining your login session, bet slip, and security preferences. They cannot be disabled without affecting how the site functions
• Performance cookies — collect aggregated information about how users navigate the platform (most visited pages, average session duration, errors encountered) to help us improve the experience. They do not identify users individually
• Security cookies — used to detect unauthorized access attempts, bot activity, and suspicious behavioral patterns that may indicate fraud or manipulation
• Preference cookies — store your platform preferences, such as language and notification settings, so you don't have to reconfigure them every time you log in

99hi does not use behavioral advertising cookies from third-party networks. You can manage your cookie preferences directly in your browser. Most browsers allow you to block or delete cookies, though doing so may affect the functionality of certain platform features.

99hi is a platform exclusively for users 18 and older. We do not intentionally collect personal data from minors. During registration, we ask for your date of birth and perform verification checks to ensure that only users 18 and older can create and maintain active accounts.

If 99hi determines that a user is under 18, the account will be closed immediately, all collected data will be deleted within 15 business days, and any deposited balance will be returned to the verified legal guardian. If you believe a minor has created an account on the platform, please contact us immediately at suporte@99hi.best.

The LGPD grants you, as the owner of personal data processed by 99hi, a set of rights that can be exercised at any time. 99hi responds to all requests within 15 business days, as required by law. Your rights are:

Some of the technology service providers used by 99hi may have infrastructure located outside Brazil. Where international transfers of personal data occur, 99hi ensures they take place only to countries or organizations that offer an adequate level of data protection, as assessed by the ANPD, or that are subject to standard contractual clauses approved by the competent regulatory authority.

International game providers (such as Microgaming, NetEnt, Evolution Gaming, and Playtech) receive only anonymized session identifiers, with no personally identifiable data from Brazilian users. This minimizes the volume of personal data transferred internationally to only what is strictly necessary for the games to function.

99hi may update this Privacy Policy to reflect changes in Brazilian legislation, data processing practices, or the services offered. When significant changes are made, we will notify you at least 15 days in advance by email and through a visible notice on the platform.

The date of the most recent revision is always shown at the top of this page. We recommend checking it periodically. Your continued use of 99hi's services after a revised version of this Policy takes effect constitutes your acceptance of the changes made.

To exercise any of your rights under the LGPD, ask questions about this Policy, or report any concerns related to the processing of your personal data, please contact 99hi through the following channels:

• DPO email: suporte@99hi.best — use the subject line "LGPD – [Request Type]" to help us process your request faster
• Live chat on the platform — available 24 hours a day, 7 days a week, for urgent account security matters
• Response time: up to 15 business days for data subject rights requests

If you are not satisfied with 99hi's response to a privacy-related request, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.