Privacy Policy of 6lll — How We Protect Your Data

The controller of the personal data processed under this Policy is the platform 6lll, accessible at https://6lll.best. For the purposes of the LGPD (Lei nº 13.709/2018), the controller is the legal entity responsible for decisions regarding the processing of your personal data.

The data protection officer (DPO — Data Protection Officer) of 6lll can be reached by email at suporte@6lll.best with the subject line "Data Protection — LGPD". All requests to exercise data subject rights are forwarded to the DPO for review and response within the timeframes required by law.

The 6lll collects personal data in the following situations:

Data provided directly by you

• Registration: full name, CPF, date of birth, email address, mobile number, residential address with zip code;
• KYC verification: copy of a government-issued ID (RG, CNH, or passport), proof of address, verification photo when requested;
• Payments: Pix key, credit or debit card details (processed by certified payment gateways), bank transfer details via Nubank, Itaú, Bradesco, Banco do Brasil, and other partner banks;
• Communications: content of messages sent to support via live chat or email.

Automatically collected data

• IP address, browser type, and device operating system;
• Device identifiers (device ID, session cookies);
• Pages visited, access times, click events, and navigation flow on the platform;
• Approximate geolocation data derived from IP address, used for regulatory compliance;
• Betting history, financial transactions, and games played on the platform.

The 6lll does not collect data in sensitive categories, such as health or biometric data, racial or ethnic origin, religious beliefs, or sexual orientation, except where required by law.

Each data processing activity carried out by the 6lll has a specific purpose and is grounded in one of the legal bases established by the LGPD. The main uses are:

• Contract performance: account creation and maintenance, processing of deposits via Pix and other methods, withdrawal processing, and provision of Sports Betting and casino services;
• Legal obligation: identity verification (KYC), anti-money laundering compliance, fulfillment of court orders, and regulatory obligations in the betting sector;
• Legitimate interest: fraud prevention, platform security, detection of multiple accounts, behavioral analysis for service improvement, and dispute resolution;
• Consent: sending marketing communications and promotions, use of non-essential analytical cookies, and content personalization based on betting history.

Where processing is based on consent, you may withdraw that consent at any time without affecting any processing that was carried out on that basis prior to withdrawal.

The 6lll does not sell, rent, or otherwise commercialize your personal data. Sharing is carried out only in the following situations, always with appropriate contractual safeguards:

Service providers

Payment providers that process Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transactions receive only the minimum data required to complete the transaction. All providers are contractually required to comply with the LGPD and maintain security protocols equivalent to those of the 6lll.

Game developers

Casino, slots, and crash game providers receive game session identifiers to record and verify results. These providers do not receive personally identifiable data such as CPF, address, or banking details.

Public authorities

The 6lll may share data with law enforcement, judicial, regulatory, or tax authorities when required by law, court order, or directive from a competent authority. In such cases, sharing is limited to what is strictly necessary and, where legally permitted, the user will be notified.

The personal data of users of 6lll are stored on servers with the following technical and organizational safeguards:

• Encryption in transit: all communication between your device and the servers of 6lll is protected by TLS 1.2 or higher;
• Encryption at rest: sensitive data, including identity documents and banking information, is stored with AES-256 encryption;
• Access control: access to data is restricted to employees and systems with a proven operational need, with mandatory multi-factor authentication for administrative access;
• Audit logs: all access to personal data is logged with the date, time, user and system ID, and purpose;
• Security testing: the platform undergoes regular penetration testing and vulnerability assessments carried out by specialized teams.

Despite all these controls, no security system is completely impenetrable. The 6lll maintains a security incident response plan to act quickly in the event of anything that could compromise your data.

The 6lll retains your personal data for as long as necessary to fulfill the purposes for which it was collected, or to comply with legal and regulatory obligations. The general retention periods are:

• Registration and KYC data: retained for as long as the account remains active and for at least five years after closure, as required by anti-money laundering legislation;
• Financial transaction history: retained for ten years from the date of the transaction, in accordance with the Brazilian Civil Code and applicable tax legislation;
• Betting and gaming history: retained for five years for support purposes, dispute resolution, and compliance with regulatory obligations;
• Support communication data: retained for two years after the ticket is closed, for quality and training purposes;
• Analytical cookies: session data is cleared when the browser is closed; persistent cookies respect the expiry period set for each cookie, typically between 30 and 365 days.

Once retention periods expire, data is securely deleted or irreversibly anonymized. Anonymized data may be retained indefinitely for statistical and service improvement purposes.

The 6lll uses cookies and similar technologies to ensure the platform works correctly and to improve the user experience. The types of cookies used are:

Essential cookies

Required for the platform's core functionality — authentication, session management, language preferences, and security. These cannot be disabled as doing so would compromise your use of the platform. They do not collect data for marketing purposes.

Analytical cookies

Used to understand how users interact with the platform — which pages are visited most, where crashes occur, and which features are used most often. Data is aggregated and anonymized. These cookies can be declined without affecting access to the platform.

Personalization cookies

Remember your display preferences, favorite games, most-followed sports, and interface settings to deliver a personalized experience on future visits. Require your consent.

You can manage your cookie preferences in your account settings panel or directly through your browser settings. Browsers such as Chrome, Firefox, Safari, and Edge allow you to block, clear, or review cookies individually.

The platform 6lll is intended exclusively for individuals who are 18 years of age or older. The 6lll does not intentionally collect personal data from users under 18. The identity verification (KYC) process includes date-of-birth confirmation to prevent minors from registering.

If you become aware that a user under 18 has created an account on 6lll or is using your account, contact us immediately via the support chat or by email at suporte@6lll.best to have the account preventively blocked. All data associated with confirmed minor accounts will be deleted as soon as the situation is verified.

To exercise any of your rights as a data subject under the LGPD, you may:

• Go to "My Account" > "Privacy" directly on the 6lll for access, correction, and withdrawal of consent for marketing communications;
• Send an email to suporte@6lll.best with the subject line "LGPD Rights", providing your full name, registered CPF, and the right you wish to exercise;
• Reach out via live chat (available 24 hours a day) for urgent requests or questions about how to proceed.

Response times

The 6lll will respond to rights exercise requests within fifteen business days of receiving the complete request. In complex cases requiring additional review, this period may be extended by a further fifteen business days, with notice to the requester explaining the reason for the extension.

The requester's identity will be verified before any access, portability, or deletion request is fulfilled, ensuring that personal information is never disclosed to unauthorized third parties.

If you believe that 6lll did not adequately handle your request or that the LGPD has been violated, you have the right to file a complaint with the National Data Protection Authority (ANPD), pursuant to Article 55 of Law No. 13,709/2018.

Some of the technology partners of 6lll — such as cloud infrastructure providers, casino and slots game developers, and security analytics systems — may process data on servers located outside Brazil.

When such transfers occur, 6lll guarantees that:

• The destination country provides an adequate level of personal data protection, as assessed by the ANPD, or;
• The agreement with the provider includes standard contractual data protection clauses that ensure a level of protection equivalent to that required by the LGPD;
• Only the minimum data necessary for the specific purpose is transferred, and all transfers are carried out with the technical security measures described in this Policy.

International data transfers in the context of 6lll primarily involve technical session data with game providers and aggregated traffic analytics data. Sensitive financial data, such as Pix keys and banking details, is processed exclusively by providers operating within Brazil.

In the event of a security incident that may pose a relevant risk or harm to data subjects — such as unauthorized access to personal data, information leaks, or improper destruction of data — the 6lll will take the following measures:

• Immediate containment of the incident and assessment of the impact on the affected data;
• Notification to the National Data Protection Authority (ANPD) within two business days of becoming aware of the incident, as per art. 48 of the LGPD;
• Notification to affected users via their registered email address, describing the nature of the data involved, the potential consequences, and the measures taken to protect it;
• Implementation of corrective measures to prevent the incident from recurring.

If you suspect unauthorized access to your account at 6lll, change your password immediately and contact support via live chat for a preventive block and investigation.

The 6lll may update this Privacy Policy periodically to reflect changes in applicable legislation, data processing practices, or new platform features. The date of the most recent update is always shown at the top of this page.

For significant changes that affect data subjects' rights or expand the purposes of data processing, 6lll will notify active users by email at least ten calendar days before any changes take effect.

Continued use of the platform after changes are published constitutes acceptance of the updated processing terms, except where the legal basis requires fresh express consent — in which case you will be asked to confirm your agreement before continuing to use the platform.

To exercise your rights, get clarification on this Policy, or submit any complaint regarding the processing of your personal data by 6lll, please contact our data protection officer (DPO):

• Email: suporte@6lll.best (subject: "Data Protection — LGPD")
• Live chat: available 24 hours a day, seven days a week, directly on the platform
• Response time: up to fifteen business days for rights requests; up to two business days for general support

The 6lll takes every privacy and personal data request seriously. Our DPO is ready to respond in Portuguese and guide you through exercising your rights as simply as possible.