Privacy Policy SP11 – Your Data Protected and Under Your Control

1 Who Controls Your Data

The controller of personal data collected through the SP11 platform is SP11 itself, the operator of sp11.best. As the data controller, SP11 is responsible for making decisions about how your personal data is processed — what to collect, for what purpose, how long to retain it, and with whom to share it.

SP11's Data Protection Officer (DPO), responsible for receiving and responding to data subject requests, can be contacted at privacidade@sp11.best. All requests related to personal data must be sent exclusively to that address, with the CPF registered on the account included in the body of the message for identity verification purposes.

2 What Data We Collect

SP11 collects only the data necessary to provide its services and meet legal obligations. The categories of data we process are listed below:

3 Why We Collect Your Data

Every piece of data collected by SP11 has a specific purpose. The table below summarizes the main purposes of data processing:

SP11 does not use your data for third-party marketing purposes or to sell behavioral profiles to external advertisers. Marketing communications from SP11 itself — such as promotion and bonus notifications — are only sent with your express consent, and you can opt out at any time through your account dashboard or by replying "unsubscribe" to any email you receive.

4 Legal Bases for Processing (LGPD)

The LGPD requires that all personal data processing have a specific legal basis. SP11 relies on the following legal bases, as set out in Article 7 of Law No. 13,709/2018:

• Contract Performance — Processing is necessary to fulfill the obligations set out in our Terms and Conditions, such as processing your Pix deposits, settling bets and managing your account balance.
• Legal Obligation — Certain processing activities are required by law, such as the financial transaction records mandated by the Banco Central do Brasil and anti-money laundering obligations (Law No. 9,613/1998).
• Legitimate Interest — We rely on this legal basis for purposes such as fraud prevention, security analysis, and continuous platform improvement, always ensuring that our interests do not override users' rights and reasonable expectations.
• Consent — For marketing communications, non-essential cookies and certain optional features, we ask for your explicit consent. You may withdraw that consent at any time without affecting your use of the main service.

5 Data Sharing with Third Parties

SP11 shares personal data only with the following categories of third parties, always under contracts that impose confidentiality obligations and LGPD compliance:

• Payment processors — To process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay and Mercado Pago. Only the data strictly necessary for the transaction is shared.
• Anti-fraud systems — Partners specialized in fraud detection and anti-money laundering receive technical and transactional data for risk analysis. The data is used solely for that purpose.
• Game Providers — For live casino games (such as those from Evolution Gaming and Pragmatic Play), technical session data may be shared to enable the gaming experience. Providers do not receive personally identifiable data beyond what is strictly necessary.
• Technology infrastructure — Cloud hosting and CDN services that keep the platform running. These providers have technical access to data but do not use it for any purpose of their own.
• Public Authorities — In the event of a court order, request from a competent authority, or a legally mandated obligation, SP11 may provide data to Brazilian authorities. Whenever legally permitted, the user will be notified.

6 How Long We Retain Your Data

SP11 retains your personal data for as long as needed to fulfill the purposes described in this policy and to comply with applicable legal obligations. The criteria that determine retention periods include:

• Identification data and active account: retained for the full duration of the account and for up to 5 years after closure, in accordance with Banco Central and Receita Federal requirements for financial transaction records.
• Financial transaction history: retained for a minimum of 5 years from the transaction date, as required by anti-money laundering legislation.
• KYC documents (ID, proof of address): retained for up to 5 years after account closure or the last transaction, whichever occurs later.
• Browsing data and non-essential cookies: retained for the duration of the cookie's validity period, generally up to 12 months, unless consent is renewed.
• Support communications: retained for up to 2 years after the ticket or account is closed, for dispute resolution purposes.

Once the retention period expires, data is securely deleted or irreversibly anonymized. Anonymized data no longer qualifies as personal data under the LGPD and may be used for statistical purposes indefinitely.

7 How We Protect Your Data

SP11 applies robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or improper destruction:

• Encryption in transit: all communications use TLS 1.3 / SSL 256-bit encryption. No data travels in plain text between your device and our servers.
• Encryption at rest: sensitive data — including KYC documents and passwords — is stored using AES-256 encryption. Passwords are never stored in plain text.
• Multi-factor authentication (2FA): available to all users and mandatory for withdrawal transactions above R$ 5,000.00.
• Internal access controls: only employees with an operational need have access to users' personal data, and all access is recorded in audit logs.
• 24-hour monitoring: automated systems detect unauthorized access attempts, suspicious behavior, and potential data breaches in real time.
• Security audits: SP11's infrastructure undergoes periodic penetration testing and security audits conducted by specialized third-party firms.

8 Cookies and Tracking Technologies

SP11 uses cookies and similar technologies to ensure the platform runs correctly, improve the user experience, and — with your consent — analyze platform usage. The types of cookies we use are:

• Essential Cookies — Required for the basic operation of the platform: maintaining authenticated sessions, language preferences, and security. These cannot be disabled without affecting your use of the service.
• Performance cookies — These collect information about how you use the platform (which pages you visit, time spent) in anonymized form. Used to improve SP11's speed and usability on mobile and desktop.
• Functionality cookies — These remember your usage preferences (such as your preferred deposit method or active notifications) to personalize your experience.
• Security cookies — Detect anomalous login behavior and protect your account against unauthorized access attempts and brute-force attacks.

You can manage your cookie preferences through your browser settings or via the privacy options available in your SP11 account dashboard. Disabling essential cookies may prevent certain features from working correctly, such as persistent login.

9 Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a data subject, a robust set of rights regarding your personal data processed by SP11. See below what you can request and how to exercise each right:

10 Minors

Sp11 is a platform intended exclusively for users aged 18 and over, in accordance with Brazilian law. sp11 does not knowingly collect personal data from minors under 18 and does not allow children or adolescents to create accounts or use any of the platform's services.

If SP11 identifies that it has collected data from a user under 18, the account will be immediately closed, the data will be deleted as quickly as possible, and — if a financial transaction is involved — the amount will be refunded to the original payment method after ownership verification.

If you, as a legal guardian, discover that a minor has used the SP11 platform, please contact us immediately at privacidade@sp11.best. We will act promptly to close the account and delete the collected data.

11 International Data Transfer

To enable online casino services — particularly live games provided by partners such as Evolution Gaming and Pragmatic Play, whose servers may be located outside Brazil — the transfer of some technical session data abroad may be required.

All international data transfers carried out by SP11 comply with LGPD requirements, which mandate that the destination country offer an adequate level of data protection, or that the recipient party contractually commit to upholding data subjects' rights to the same standard required under Brazilian law.

Personal identification data — such as CPF, full name, and financial details — is not transferred to servers outside Brazil. Only the technical data strictly necessary for the gaming session (session identifier, bet results) is shared with international providers under contracts that include specific data protection clauses.

12 Changes to this Privacy Policy

SP11 may update this Privacy Policy periodically to reflect changes in Brazilian law — particularly ANPD regulations —, updates to the services offered, or improvements to our security and privacy practices.

Significant changes that directly affect data subjects' rights will be communicated via registered email at least 15 calendar days in advance. The "last updated" date visible at the top of this page is always refreshed with every revision, regardless of the scope of the changes.

Continued use of the SP11 platform after a new version of this policy takes effect constitutes acceptance of the changes. If you disagree with the new terms, you may close your account and request deletion of your data as described in Section 9.

13 Contact, DPO & Whistleblower Channel

For any questions related to privacy, data protection, or exercising your rights as a data subject, please use the channels below. All requests are answered within 15 business days, at no cost.

If you believe sp11 has handled your personal data in violation of the LGPD and are not satisfied with our response, you have the right to file a complaint with the ANPD, the authority responsible for enforcing the LGPD in Brazil.