9games Privacy Policy – Your Data Protected by the LGPD

The 9games, operator of the platform available at 9games.best, is the controller of the personal data collected from users under the terms of this Privacy Policy and the Brazilian General Data Protection Law (LGPD — Law 13.709/2018).

As the data controller, 9games is responsible for defining the purposes and means of processing the personal data collected — and for ensuring that such processing takes place within the bounds of the law and the reasonable privacy expectations of Brazilian users.

For any privacy or data protection questions, the direct contact channel is contato@9games.best, with the subject line "Privacy" or "LGPD Request".

The 9games collects only the data strictly necessary to deliver the platform's services safely and with quality. Below is a breakdown of the data collected by category:

Credit/debit card details are never stored directly on 9games servers — they are tokenized by the certified payment processors the platform works with.

The 9games uses the personal data collected exclusively for the following purposes:

• Create and manage your account: your name, CPF, email, and phone number are required to identify you as a unique user on the platform and to ensure secure access;
• Process deposits and withdrawals: financial data is used to process transactions via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED bank transfer in a secure and timely manner;
• Verify identity (KYC): submitted documents are used to confirm your identity and verify that you meet the eligibility requirements — a process required by anti-money laundering regulations;
• Prevent fraud and protect the platform: behavioral data and technical data are analyzed to identify suspicious usage patterns, duplicate accounts, or activity that violates 9games' Terms and Conditions;
• Personalize your experience: behavioral data is used to suggest relevant content — such as football matches from the Brasileirão you usually follow or crash game promotions that match your profile — and is never used to build a profile for sale to external advertisers;
• Fulfill legal obligations: financial and identification records are retained for the minimum period required by the Banco Central do Brasil and other applicable regulations;
• Keep you informed about your account and the platform: Transactional emails (deposit confirmations, security alerts, withdrawal notifications) are sent without requiring additional consent, as they are part of the service itself. Marketing emails and promotions are only sent with explicit consent.

9games does not use your data for fully automated decision-making that produces significant legal effects on you, except in cases of automatic fraud detection — where a human review is always available upon request.

Every data processing operation carried out by 9games has a defined legal basis in accordance with article 7 of the LGPD:

• Contract performance (art. 7º, V): processing required to deliver the contracted service when you create an account — including payment processing, account management, and customer support;
• Compliance with a legal or regulatory obligation (art. 7, II): identity verification (KYC), financial records, and anti-money laundering compliance are legal requirements that 9games must meet regardless of the user's preferences;
• Legitimate interest (art. 7, IX): behavioral analysis for fraud prevention, platform security, and continuous service improvement — always balanced against users' privacy rights and expectations;
• Consent (art. 7, I): sending personalized marketing communications and promotions. Consent may be withdrawn at any time without affecting your access to the platform.

The 9games does not sell, rent, or transfer users' personal data to third parties for any commercial purpose. Data is shared only in the following situations and with the categories of partners listed below, all of whom are subject to confidentiality agreements compatible with the LGPD:

• Payment processors: to process transactions via Pix, boleto, credit/debit card, PicPay, and Mercado Pago — we share only the data strictly necessary to complete the specific transaction;
• Game providers: Evolution Gaming, Pragmatic Play, Spribe, and other certified providers receive anonymous session identifiers required to run the games — no full personal data is shared;
• Technical service providers: cloud infrastructure providers, transactional email services, and analytics tools — all bound by data protection clauses equivalent to those required under the LGPD;
• Competent authorities: when required by court order, by determination of the Central Bank of Brazil, or by another regulatory authority with legal jurisdiction to do so — 9games will notify the user whenever legally permitted.

Any new partner that may eventually need access to users' personal data will undergo the same security and privacy due diligence before any integration takes place. The list of partner categories may be updated with prior notice to users.

The 9games retains users' personal data for as long as necessary to fulfill the purposes stated in this policy, in compliance with the minimum retention periods required by law:

• Active account data: retained for the entire period during which the account remains active;
• Financial and transaction data: retained for a minimum of 5 years after the transaction, as required by the Banco Central do Brasil and Brazilian tax legislation;
• Identity verification documents (KYC): retained for a minimum of 5 years after account closure, in compliance with anti-money laundering regulations;
• Support communication records: retained for up to 2 years after account closure for dispute resolution purposes;
• Marketing data and preferences: deleted immediately upon consent withdrawal or account closure, whichever comes first.

After the minimum legal retention period, data is securely and permanently deleted from 9games systems — with no possibility of recovery. Anonymized data (with no means of individual identification) may be retained indefinitely for statistical purposes and platform improvement.

To request early deletion of data not subject to legal retention obligations, send your request to contato@9games.best with the subject line "Data Deletion".

The 9games implements technical and organizational measures to protect users' personal data against unauthorized access, alteration, improper disclosure, accidental loss, and destruction. Measures in place include:

• TLS encryption: all communication between the user's device and 9games servers is encrypted with TLS 1.2 or higher;
• Encrypted storage: sensitive data — such as identity documents and financial information — is stored with additional encryption at rest;
• Access control: only employees with a legitimate need are granted access to specific personal data, and all access is logged for audit purposes;
• Payment data tokenization: credit and debit card data is tokenized by certified payment processors — 9games never stores card numbers on its servers;
• Continuous monitoring: intrusion detection and anomaly monitoring systems watch the platform in real time to identify and neutralize threats quickly;
• Periodic security testing: 9games infrastructure undergoes regular security assessments, including penetration testing by specialized teams.

In the event of a security incident that may affect users' personal data, 9games will notify the affected users and the National Data Protection Authority (ANPD) within the timeframe established by the LGPD — 2 business days after becoming aware of the incident — providing details on the nature of the event, the data affected, and the measures taken to mitigate the risks.

The 9games uses cookies and similar technologies to ensure the platform works correctly and to continuously improve the user experience. The types of cookies used are:

• Essential cookies: required for basic platform operation — session authentication, bet slip maintenance, language preferences. Without these cookies, the platform will not function properly. They cannot be disabled;
• Analytical cookies: used to understand how users interact with the platform — which sections are most visited, which features cause difficulty, and how long users spend in each area. Data is aggregated and anonymized;
• Preference cookies: store personal settings such as display theme, preferred betting limits, and active notifications. They make the platform easier to use without requiring reconfiguration on every visit.

9games does not use third-party tracking cookies for advertising purposes. No behavioral data from the platform is shared with external advertising networks.

You can manage or block non-essential cookies at any time in your browser settings. In Chrome, Firefox, Safari, and Edge, cookie management is found under Settings → Privacy and Security. Blocking essential cookies may prevent login and other 9games features from working correctly.

Types of cookies used on 9games:

The platform 9games is intended exclusively for users who are 18 years of age or older. 9games does not knowingly collect personal data from individuals under 18.

If we identify that an underage user has created an account on the platform, the account will be immediately closed, the associated data will be deleted, and any deposited balance will be refunded to the original payment method.

If you believe a minor may have created a 9games account using false or third-party information, please contact our team immediately at contato@9games.best so we can investigate and take the appropriate action with the highest priority.

Some technical partners and game providers of 9games may have infrastructure located outside Brazil. When personal data is transferred to servers in other countries, 9games ensures that:

• The destination country offers an adequate level of data protection, as assessed by the ANPD; or
• The transfer is covered by specific contractual clauses that guarantee the user protections equivalent to those provided under the LGPD; or
• The partner has adopted globally recognized data protection standards, such as OECD guidelines or equivalent certifications.

Financial and identification data of Brazilian users is stored primarily on servers located in Brazil or in the European Union — a region with privacy regulations (GDPR) that are equivalent to or stricter than Brazil's LGPD.

You may request information about the destination countries of your specific data at any time by emailing contato@9games.best.

To exercise any right provided under the LGPD regarding your data at 9games, follow the steps below:

• Contact channel: send an email to contato@9games.best with the subject line "LGPD Request";
• Required information: include in your email your full name, CPF, email address registered on the platform, and a clear description of the right you wish to exercise (access, correction, deletion, portability, consent withdrawal, or objection);
• Identity verification: to protect your data, 9games may request additional identity confirmation before processing your request;
• Response time: up to 15 business days from receipt of the complete request, as provided under the LGPD;
• Response format: information will be provided by email in the clearest and most organized format possible — or in a structured format for portability requests.

If a request cannot be fulfilled — due to a legal retention obligation or another legitimate reason — 9games will clearly explain why and outline the options available to the user, including the right to file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).

The 9games may update this Privacy Policy periodically to reflect changes in its services, applicable legislation, or data processing practices. Any material change — that expands the scope of data collection or modifies the purposes for which data is used — will be communicated by email at least 15 calendar days before taking effect.

Changes that reduce the scope of data collection or expand users' rights may take effect immediately, with notice provided at the time of publication.

The date of the last update to this policy is indicated at the top of this page. We recommend checking this page whenever you receive an update notification from 9games. Continued use of the platform after the effective date of the new terms constitutes acceptance of the changes.

In accordance with article 41 of the LGPD, the 9games has appointed a Data Protection Officer (DPO) responsible for:

• Receive and respond to data subject requests;
• Guide the internal team on data protection practices;
• Serve as the point of contact with the ANPD (Autoridade Nacional de Proteção de Dados);
• Oversee compliance with this policy and the LGPD across all platform operations.

To contact the 9games DPO or for any privacy and data protection inquiries:

• Email: contato@9games.best (subject: "DPO" or "Privacy")
• Live chat: available 24/7 on the 9games.best platform
• Response time: up to 15 business days for LGPD requests

For more information about the platform's usage rules, please refer to our Terms and Conditions. For information on responsible gambling, visit our Responsible Gambling.