Privacy Policy – win2023: your data protected

This Privacy Policy describes how win2023 collects, stores, uses, and protects the personal data of users who access and use the platform available at win2023.my, including all Sports Betting, Live Casino, slots, crash games, and other products offered.

At win2023 is the controller of personal data collected through the platform and is committed to handling it responsibly, transparently, and in full compliance with Brazil's General Data Protection Law (LGPD – Lei nº 13.709/2018) and all other applicable regulations.

This policy applies to all users of win2023, including website visitors who have not registered, registered users, and anyone who interacts with the platform's services by any means — whether through a desktop browser, a mobile device, or any available apps.

At win2023 collects personal data at different points during your interaction with the platform. Below, we describe the main categories of data collected and the context in which each collection takes place.

Data provided directly by you:

• Full name and CPF (required for registration and identity verification)
• Date of birth (for age verification)
• Email address and Brazilian mobile number
• Full residential address (required for KYC verification on withdrawals)
• Identity documents: RG, CNH, or passport (when required)
• Proof of residence in the account holder's name
• Bank or digital wallet details for processing Pix, boleto bancário, credit and debit cards, PicPay, Mercado Pago, and TED transfers

Data collected automatically during use:

• IP address and approximate geographic location
• Device type, operating system, and browser used
• Betting history, deposits, and withdrawals on the platform
• Session time, pages visited, and interface interactions
• Cookies and similar tracking technologies (detailed in section 6)

The data collected by win2023 are used exclusively for the purposes described below. No data is used for purposes incompatible with what was communicated at the time of collection.

At win2023 does not use your data to make automated decisions that produce legal effects or significantly impact your interests, except within fraud detection systems, where any preventive block is reviewed by a human team before any definitive action is taken.

At win2023 processes your personal data based on the legal grounds set out in Articles 7 and 11 of the LGPD. Each processing purpose has a specific legal basis that justifies and legitimizes the use of your data.

• Contract performance (Art. 7, V): to create your account, process bets, deposits, and withdrawals, and provide the services you agreed to when registering with win2023
• Compliance with a legal obligation (art. 7, II): for identity verification (KYC), anti-money laundering compliance, and adherence to applicable regulatory requirements in the sector
• Legitimate interest (art. 7, IX): for fraud prevention, platform security, and improving the user experience based on anonymized usage data
• Consent (art. 7, I): to send promotional communications, betting notifications, and marketing by email or mobile — you may withdraw this consent at any time in your account settings

Where processing is based on consent, win2023 will ensure it is obtained freely, informedly, and unambiguously prior to any processing. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

At win2023 does not sell, rent, or trade your personal data with third parties. Data sharing occurs only in the situations described below, strictly for the purpose of enabling service delivery or fulfilling legal obligations.

• Payment processors: to facilitate deposits and withdrawals via Pix, boleto bancário, credit or debit cards, PicPay, Mercado Pago, and TED transfers. Only the data necessary for each transaction is shared, under a confidentiality agreement
• Game providers: companies such as Evolution Gaming, Pragmatic Play, PG Soft, and Spribe receive user identifiers (with no sensitive personal data) solely to enable the gaming session
• Security and anti-fraud tools: suspicious pattern detection systems operating on anonymized or pseudonymized data
• Competent authorities: in compliance with court orders, requests from regulatory authorities, or legal obligations, such as reports to COAF (Brazil's Financial Activities Control Council)

At win2023 does not share data with third-party advertising networks for behavioral targeting without the user's explicit consent. Any analytics cookies used on the platform are described in the following section.

At win2023 uses cookies and similar technologies to ensure the platform works correctly, personalize the user experience, and collect analytical usage data. No third-party advertising cookies are used without your consent.

• Strictly necessary cookies: essential for the platform to function — such as keeping your session active, remembering language preferences, and processing bets. They cannot be disabled without compromising your use of the service
• Performance cookies: collect anonymized data on how users navigate the platform, which pages are visited most, and where errors occur. Used exclusively to improve the platform
• Functionality cookies: store user preferences — such as favorite sports and odds display settings — to personalize the experience without requiring reconfiguration on each visit
• Analytics cookies: used by data analytics tools to understand aggregate usage patterns. They operate on anonymized data and do not identify individual users

You can manage your cookie preferences through the banner displayed on your first visit to the platform or through your browser settings. Disabling strictly necessary cookies may affect the proper functioning of the win2023. Disabling other cookie types will not affect the platform's core functionality.

At win2023 adopts robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or improper destruction. Our security approach covers both the technological infrastructure and the team's internal processes.

• 256-bit SSL Encryption: all traffic between your device and win2023's servers is encrypted using the same standard adopted by major Brazilian banks
• Encryption of data at rest: sensitive information stored on the platform's servers is encrypted, including banking details and identity documents
• Two-factor authentication (2FA): available to all users and strongly recommended to protect account access on mobile or desktop
• 24/7 Monitoring: automated intrusion detection and suspicious activity monitoring systems run continuously on the platform's servers
• Restricted access: only authorized employees with an operational need have access to users' personal data, subject to authentication and audit logging
• Regular security testing: the platform undergoes regular penetration testing and security audits conducted by specialized teams

At win2023 retains users' personal data for as long as necessary to fulfill the purposes described in this policy and to meet applicable legal obligations. The criteria used to determine retention periods include the nature of the data, the purpose of the processing, and the regulatory requirements of the sector.

• Registration data and betting history: retained for the duration of the contract and for up to 5 years after account closure, in compliance with tax and regulatory obligations
• Identity verification documents (KYC): retained for up to 5 years after account closure, in accordance with anti-money laundering regulations
• Financial transaction records: retained for up to 5 years, in compliance with Brazilian tax legislation and Central Bank regulations
• Access logs and browsing data: retained for up to 6 months, in accordance with the Brazilian Internet Civil Rights Framework (Lei nº 12.965/2014)
• Marketing communication data: retained while active consent exists, deleted within 30 days of withdrawal

Once the applicable retention periods have expired, data is securely deleted using techniques that prevent recovery, or anonymized for use in internal statistical analysis without identifying data subjects.

The LGPD grants you, as a data subject, a set of rights that win2023 is committed to respecting in full. See below what you can request at any time:

To exercise any of these rights, please contact win2023 via live chat available 24 hours a day or by email at suporte@win2023.my. Requests are answered within 15 business days, as required by the LGPD. In cases requiring additional identity verification, the deadline may be extended with a written justification provided to the data subject.

The services of win2023 are intended exclusively for individuals aged 18 and over. The platform does not knowingly collect personal data from users under 18 and actively implements age verification measures during the registration process.

If win2023 determines that it has collected data from a minor, that information will be deleted immediately and access to the platform will be terminated. If you are aware that a minor is using the platform, please contact support so we can take the necessary steps without delay.

At win2023 provides parental control and self-exclusion tools in its settings, which any user can activate to restrict access to their account. For more information about our responsible gambling policies, visit the dedicated page.

Some of the service providers used by win2023 — such as game providers and infrastructure tools — may process data on servers located outside Brazil. When this occurs, win2023 ensures that international data transfers comply with the requirements set out in Article 33 of the LGPD.

International transfers carried out by win2023 are based on one of the following safeguards:

• Transfer to countries that offer a level of personal data protection equivalent to that required by the LGPD, as assessed by the ANPD
• Standard data protection contractual clauses imposing equivalent obligations on international partners
• International certifications recognized and accepted under Brazilian regulations

You may request from win2023 support win2023 information about which international partners process your data and what safeguards are in place for each transfer.

At win2023 may update this Privacy Policy periodically to reflect changes in legislation, data processing practices, or the services offered. Whenever relevant changes are made that affect your rights as a data subject, you will be notified with reasonable advance notice.

Notification will be sent to your registered email address and displayed as a prominent notice on the platform before the new terms take effect. If you do not agree with the changes, you may request account closure before the new terms come into force.

The current version of this policy is always the one published at win2023.my/privacy-policy, with the update date shown in the document header. We recommend reviewing this policy periodically to stay informed about how win2023 protects your personal information.

To exercise your rights as a data subject, ask questions about this Privacy Policy, or file a complaint regarding the handling of your personal data, you may contact win2023 through the following channels:

• Live chat: available 24 hours a day, seven days a week, with support in Portuguese
• Email: suporte@win2023.my — responses within up to 15 business days for privacy-related requests
• Data Protection Officer (DPO): responsible for overseeing data processing at win2023, reachable at the same email address with the subject line "Privacy – DPO"

If after contacting win2023 you believe your rights have not been properly upheld, you may file a complaint with the National Data Protection Authority (ANPD), the body responsible for enforcing the LGPD in Brazil.