Privacy Policy of um8um8: your data protected with transparency

The um8um8 is the controller of personal data collected through the platform available at um8um8.net and across all associated mobile applications. Under the LGPD, the controller is the party that makes decisions about how data is collected, stored, used, and disposed of.

This Privacy Policy applies to all registered users and visitors of the um8um8 platform, regardless of the device used — desktop, mobile (Android or iOS), or any other. By using any feature of the platform, you acknowledge that you have read and understood the practices described in this document.

For any questions or requests related to this Policy or the processing of your data, please reach out via email at privacidade@um8um8.net or the live chat available 24 hours a day on the platform.

Um8um8 collects only the data necessary to operate the platform securely, meet legal obligations, and deliver a quality user experience. Data falls into three categories:

Data provided directly by you:

• Registration data: full name, date of birth, CPF, email address, and mobile phone number. This information is required to create an account.
• KYC verification data: government-issued photo ID (RG, CNH, or passport), a current proof of address, and a selfie with your document when requested.
• Financial data: Pix key (CPF, phone number, email, or random key), credit/debit card details processed in tokenized form by the payment gateway, bank account details for wire transfers.
• Communications: messages exchanged with support via live chat or email, including questions, complaints, and requests.

Data collected automatically:

• Usage data: betting history, games accessed, bet amounts and frequency, casino sessions, crash games played (Spaceman, Aviator, Mines), and total time spent on the platform.
• Technical data: IP address, browser or app type and version, device operating system, device identifiers, screen resolution, and time zone.
• Location data: approximate location derived from IP address for geographic eligibility verification and fraud prevention. um8um8 does not collect precise GPS location without explicit consent.
• Cookies and similar technologies: detailed in Section 7 of this Policy.

Every piece of data collected by um8um8 has a specific, legitimate purpose. The table below summarizes the key relationships between data, purpose, and legal basis:

Um8um8 does not use personal data for purposes incompatible with those listed above. If a new relevant purpose arises, users will be notified before any new processing begins.

The General Data Protection Law (Lei nº 13.709/2018) requires that all processing of personal data have a legal basis to justify it. um8um8 relies on the following legal bases, depending on the type of data and purpose:

• Contract performance (art. 7º, V): is the basis that underpins most of the processing. When you create an account and use the platform, you are entering into a contractual relationship. Fulfilling that contract — processing your Pix deposit, recording your bets, paying out your winnings, verifying your identity — requires processing the corresponding data.
• Legal obligation (art. 7, II): certain data collection is required by law, regardless of the preferences of um8um8 or the user. Age verification, KYC, and the retention of financial transaction records are all regulatory obligations.
• Legitimate interest (art. 7º, IX): used for activities such as fraud prevention, platform security, monitoring betting patterns to identify potential problem gambling, and usage analysis for product improvement. Legitimate interest is only applied where it does not override the user's rights and reasonable expectations.
• Consent (Art. 7, I): used for marketing communications — promotional emails, SMS offers, push notifications about bonuses and promotions. You can withdraw your consent at any time through your account dashboard or via the unsubscribe link in any communication.

Um8um8 does not sell personal data of its users to third parties, under any circumstances. Data sharing occurs only in the following situations, all of which are necessary to operate the platform:

• Payment gateways: to process deposits and withdrawals via Pix, Mercado Pago, PicPay, and TED, the required financial data (Pix key, transaction amount) is shared with partner payment processors. These processors act as data operators under contract with um8um8 and may not use the data for any other purpose.
• Casino game providers: when accessing games from Pragmatic Play, Evolution Gaming, PG Soft, Spribe, and other providers, an anonymous session identifier is sent to the provider to start the round. Providers do not receive your name, CPF, or financial details — only the session ID for that game round.
• Identity verification services: during KYC, document images may be processed by certified biometric verification services operating under a confidentiality agreement with um8um8.
• Legal and regulatory authorities: when required by law, court order, or a legitimate request from a competent authority, um8um8 provides the information mandated by the legal process. This includes the Banco Central do Brasil, the Receita Federal, and criminal investigation authorities.
• Analytics and security services: fraud monitoring and security analysis tools may process technical data (IP address, device ID) to detect suspicious access. This data is pseudonymized and used exclusively for security purposes.

Um8um8 applies additional layers of protection to financial data, given its sensitive nature. For transactions via Pix — the platform's primary payment method — the following practices are in place:

• Tokenization: credit and debit card data is never stored directly on um8um8's servers. It is immediately tokenized by our partner payment gateway, which stores the data in a PCI-DSS certified environment.
• CPF linking: all Pix transactions are linked to the CPF registered on the account. No third-party deposits are accepted, and withdrawals are only released to Pix keys registered under the same CPF — a measure that protects users from fraud attempts.
• Central Bank data: Pix transactions follow the standards of the Brazilian Payment System (SPB) supervised by the Banco Central do Brasil. BACEN may request information on specific transactions in the course of regulatory investigations.
• Transaction history: the complete history of deposits and withdrawals is retained for 5 years, as required by anti-money laundering regulations (Law No. 9,613/1998). You can access this history at any time in your account statement.

Um8um8 uses 256-bit SSL encryption on all communication between the user's device and the platform's servers, ensuring that financial data in transit cannot be intercepted by third parties.

Um8um8 uses cookies and similar technologies to ensure the platform works correctly and to improve the user experience. Cookies are divided into three categories:

• Essential cookies: required for the platform's core functionality. They keep you authenticated during your session, remember language preferences, and ensure transaction security. These cookies cannot be disabled without affecting how the platform works.
• Analytical cookies: collect information about how users navigate the platform — which pages are visited most often, where clicks occur most frequently, and page load times. Data is aggregated and anonymized, with no individual identification. Used exclusively for product improvement.
• Preference cookies: store user preferences such as visual theme, preferred payment method, favorite sports in the Sports Betting section, and saved casino games. They improve personalization without collecting sensitive data.

Um8um8 does not use third-party advertising tracking cookies — meaning there are no Facebook Ads, Google Ads, or retargeting network pixels tracking your browsing outside the platform to serve you personalized ads on other sites.

You can manage your cookie settings through the preferences panel available in the platform footer. Removing essential cookies may cause login and transaction failures — we recommend keeping only analytics and preference cookies disabled if you prefer.

Um8um8 applies multiple layers of technical and organizational security to protect users' personal data against unauthorized access, leaks, unauthorized alteration, or destruction:

• Encryption in transit: all communication between the user's device and um8um8's servers is protected by TLS 1.3 with AES-256 encryption — the same standard used by Brazil's major banks (Itaú, Bradesco, Nubank, Banco do Brasil).
• Encryption at rest: sensitive data stored in the platform's databases is encrypted at rest, ensuring that even in the event of unauthorized physical access to servers, the data cannot be read without the encryption keys.
• Two-factor authentication: available for all accounts and strongly recommended to secure your access. 2FA can be set up via SMS or an authenticator app (TOTP).
• Internal access controls: only um8um8 employees with a specific operational need have access to users' personal data. Access is recorded in audit logs and reviewed periodically.
• Security testing: the platform undergoes periodic penetration testing (pentest) conducted by independent teams to identify and remediate vulnerabilities before they can be exploited.
• Incident response plan: in the event of a data breach, um8um8 notifies affected users and the National Data Protection Authority (ANPD) within the legal deadlines set out in the LGPD.

Um8um8 retains personal data for as long as necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by law:

• Active account data: retained for as long as the account is active and for up to 5 years after closure, for dispute resolution and regulatory compliance purposes.
• Financial transaction records: 5 years, as required by the Anti-Money Laundering Law (Lei nº 9.613/1998).
• KYC Documents: for as long as the account remains active and for up to 5 years after closure. Minimum retention is required by financial fraud prevention regulations.
• Betting and gaming history: for as long as the account remains active and for up to 3 years after closure, to support dispute resolution and responsible gambling.
• Access and security logs: 12 months, for security incident investigation purposes.
• Support communications: 2 years, for staff training and dispute resolution purposes.
• Marketing data (based on consent): until consent is withdrawn. Withdrawal takes effect immediately and can be done at any time through the account dashboard.

Once retention periods have expired, data is permanently deleted or irreversibly anonymized. Anonymized data may be used for aggregated statistical analysis without identifying individual users.

The LGPD grants a comprehensive set of rights to any personal data subject in Brazil. See below for your rights and how to exercise them with um8um8:

The um8um8 platform is strictly intended for users aged 18 and over. um8um8 does not intentionally collect personal data from minors and performs age verification during the registration and KYC process.

If um8um8 becomes aware that a user under 18 has created an account and provided personal data, that data will be immediately deleted, the account will be closed, and any real-money deposit balance will be refunded to the holder of the payment method used. If you are a parent or guardian and believe a minor has registered an account on the platform, please contact us immediately at privacidade@um8um8.net.

Um8um8 also does not use data from adult users to create communications or content that could be particularly appealing to minors.

Um8um8 may update this Privacy Policy periodically to reflect changes in data processing practices, applicable legislation, or platform features. All changes will be published on this page with a revised last-updated date.

For changes that reduce user rights or significantly alter how data is used, um8um8 will send an email notification to the registered address at least 10 days before the changes take effect.

For minor changes — contact updates, language adjustments, or technical corrections — the page will be updated directly without email notification. Users can subscribe to updates for this Policy through the account settings panel.

Continued use of the platform after any changes take effect constitutes acceptance of the updated Policy. If you disagree with the changes, you may close your account and request data deletion before the effective date.

Um8um8 has appointed a Data Protection Officer (DPO) as required by the LGPD. The DPO is responsible for ensuring that data processing practices comply with applicable law and for handling requests from data subjects.

For questions related to this Privacy Policy, the processing of personal data, or the exercise of your rights as a data subject, please use the following channels:

• Privacy email: privacidade@um8um8.net (response within 15 business days)
• General email: contato@um8um8.net
• Live chat: available 24 hours a day on the platform (for urgent matters)

When submitting a rights request by email, please include: the email address registered to your account, your CPF (partially masked for security, e.g. 123.XXX.XXX-XX), and a clear description of the right you wish to exercise. This helps speed up identity verification and request processing.