10brl Privacy Policy — LGPD and Your Data

The controller of personal data collected through the platform 10brl is the company responsible for operating the website https://10brl.best. As the data controller, the 10brl determines the purposes and means of processing users' personal data, and is responsible for compliance with the LGPD and other applicable data protection regulations in Brazil.

To exercise your rights as a data subject or for any questions regarding the handling of your personal information, you can contact the 10brl through the channels listed in Section 13 of this Policy.

The 10brl collects different categories of personal data depending on how the user interacts with the platform. We collect only the minimum necessary to operate securely, meet legal obligations, and deliver a personalized experience for Brazilian players.

The 10brl does not collect sensitive data such as health information, racial or ethnic origin, sexual orientation, religious beliefs, or biometric data beyond the identity verification required by law for operating betting platforms in Brazil.

Every piece of data collected by the 10brl has a specific, declared, and legitimate purpose. We do not use your data for purposes incompatible with those described below:

The 10brl processes personal data only on the basis of one of the legal grounds set out in article 7 of the LGPD. The main bases used by the platform are:

• Contract performance (art. 7, V): Processing is necessary to perform the contract entered into with you when creating your account — including bet processing, Pix deposits, and withdrawals.
• Compliance with a legal obligation (art. 7, II): Obligations imposed by Brazilian law, such as user identification (KYC), reporting to COAF, and compliance with court orders.
• Legitimate interest (art. 7, IX): Fraud prevention, platform security, statistical usage analysis, and continuous service improvement — provided these purposes do not override the fundamental rights and freedoms of the data subject.
• Consent (art. 7, I): For sending marketing communications and for the use of non-essential cookies. Consent may be withdrawn at any time without any impact on your account.

The 10brl does not sell, rent, or otherwise commercialize your personal data to third parties. Sharing occurs only in the specific situations described below, always with appropriate safeguards:

• Payment processors: Financial institutions and payment gateways required to process transactions via Pix, boleto bancário, credit or debit card, Mercado Pago, and PicPay — all subject to regulation by the Banco Central do Brasil;
• Game providers: Content providers such as Evolution Gaming and Pragmatic Play receive session identifiers required to operate the games. They do not have access to your tax ID, address, or full banking details;
• Identity verification services: Specialized KYC companies to validate identity documents during the account verification process, as required by law;
• Competent authorities: When required by court order, request from the Ministério Público, COAF, ANPD, or other Brazilian regulatory bodies with legal authority to request information;
• Auditors and consultants: Professionals bound by professional secrecy who support compliance operations, financial auditing, and legal advisory for the 10brl.

All third parties that process data on behalf of the 10brl are selected based on security and LGPD compliance criteria, and are contractually required to handle your data with the same level of protection applied by the platform.

The 10brl retains users' personal data for as long as necessary to fulfill the purposes for which it was collected and to meet applicable legal obligations in Brazil.

• Registration and identity data (KYC): retained for a minimum of 5 years after account closure, in compliance with Brazilian anti-money laundering and financial regulation requirements;
• Financial transaction history: retained for a minimum of 5 years for audit, regulatory oversight, and tax compliance purposes;
• Betting history and game sessions: retained for 3 years for support, dispute resolution, and responsible gambling analysis purposes;
• Marketing communication data: retained for the duration of consent and for up to 6 months after withdrawal, as proof of lawful processing;
• Support records: retained for 2 years for quality assurance and dispute resolution purposes.

Once the applicable retention period expires, data is securely deleted or anonymized in a way that makes re-identification impossible.

The 10brl adopts technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. The main safeguards in place include:

The LGPD grants you, as a personal data subject, a set of rights that may be exercised at any time with the 10brl. See what you can request:

To exercise any of the rights above, contact us at privacidade@10brl.best or via the support chat. The 10brl will respond within the legal deadline of 15 calendar days from the date the request is received.

The 10brl uses cookies and similar technologies to ensure the platform functions correctly, enhance the user experience, and carry out usage analytics. There are three categories of cookies in use:

• Essential cookies: Required for the basic operation of the platform — session authentication, security, betting cart, and language preferences. These cannot be disabled without affecting platform functionality;
• Analytical cookies: Collect anonymous data on how users navigate the 10brl — which pages are visited most, session duration, navigation flow. Used exclusively to improve the platform. Require your consent;
• Preference cookies: Store personal preferences such as language, interface theme, and gameplay settings to personalize your experience on future visits.

You can manage, block, or delete cookies in your browser settings (Chrome, Firefox, Safari, Edge). Blocking essential cookies may prevent access to certain platform features. Analytical and preference cookies can be disabled without affecting basic use of the 10brl.

The platform 10brl is intended exclusively for individuals aged 18 and over, as established in the Terms and Conditions and in applicable Brazilian legislation governing games and Sports Betting. The 10brl does not intentionally collect personal data from individuals under 18.

The identity verification (KYC) process includes confirming the date of birth via an official photo ID. Accounts found to have been created by minors are closed immediately upon detection, and any deposited balance is returned to the original payment method after verification.

Some of the service providers used by the 10brl — such as live game platforms (Evolution Gaming, Pragmatic Play) and technology infrastructure services — may be located outside Brazil or process data on international servers.

When an international transfer of personal data takes place, the 10brl adopts the safeguards set out in the LGPD to ensure that the level of protection afforded to your data is equivalent to that required by Brazilian law:

• Transfers to countries with an adequate level of data protection recognized by the ANPD;
• Standard contractual clauses requiring the recipient to protect data with the same level of rigor as the LGPD;
• International security and privacy certifications from our providers (ISO 27001, SOC 2).

In all cases, data transferred internationally is limited to the minimum necessary for the specific service, and providers are not authorized to use that data for their own purposes beyond what is contractually established with the 10brl.

The 10brl may update this Privacy Policy periodically to reflect changes in Brazilian legislation, data processing practices, or the services offered by the platform.

When significant changes are made, you will be notified by email at your registered address and by a prominent notice when you next access the platform. For changes that affect your fundamental rights, you will receive at least 15 days' notice before the new version takes effect.

The most current version of this Policy is always the one published at https://10brl.best/privacy-policy. The date of the last update is shown at the top of this page and in the footer of this document. Continued use of the platform after an updated version takes effect constitutes acceptance of the new terms.

To exercise your rights as a data subject, clarify questions about this Policy, or report a concern related to the processing of your personal data by the 10brl, use the channels below:

• Privacy email: privacidade@10brl.best (response within 15 calendar days, as required by law)
• General support: suporte@10brl.best or live chat available 24 hours a day in Brazilian Portuguese
• Data Protection Officer (DPO): dpo@10brl.best — responsible for facilitating communication between data subjects, the controller, and the ANPD

If you believe your rights as a data subject have not been adequately addressed by the 10brl, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), the federal body responsible for overseeing LGPD compliance in Brazil. The ANPD's contact details are available on the official Brazilian federal government website.

The 10brl is committed to responding to all personal data requests with care, clarity, and within the legally required timeframes. Protecting your privacy is not a compliance checkbox — it is part of the trust you place in the platform.