Privacy Policy of 22aa — Your Data Protected

1. Who We Are — The Data Controller

For the purposes of the LGPD, the controller of the personal data collected on this platform is 22aa, which is responsible for determining the purposes and means of processing users' personal information.

The official channel for privacy and data protection matters is the email privacidade@22aa.best, managed by the 22aa Data Protection Officer (DPO). For general operational inquiries, support is available at suporte@22aa.best, 24 hours a day.

2. Data We Collect

22aa collects personal data at various points during your interaction with the platform. The information processed is categorized below:

2.1 Registration Data

• Full name;
• CPF (Cadastro de Pessoas Físicas);
• Date of birth;
• Email address;
• Mobile phone number;
• Residential address (zip code, city, state);
• Government-issued ID (RG or CNH), when requested for KYC verification.

2.2 Financial Data

• Pix key registered for withdrawals;
• Bank account details for TED transfers (bank, branch, account number);
• Deposit and withdrawal history;
• Payment method used (Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago).

22aa does not store complete credit or debit card data. Card payment processing is handled directly by PCI-DSS certified processors, which never transmit raw card data to 22aa's servers.

2.3 Platform Usage Data

• Full Sports Betting and casino game history;
• IP address and approximate IP-based location;
• Device type, operating system, and browser;
• Access logs including date, time, and session duration;
• Interactions with platform features (live betting, accumulators, markets accessed).

2.4 Support Communications

When you contact 22aa's support team via chat or email, the content of those conversations is recorded for case resolution, team training, and continuous service improvement purposes. Conversations are stored for up to 2 years after the case is closed.

3. How We Use Your Data

22aa uses the personal data collected for the following purposes, each with a legal basis identified under the LGPD:

• Account operation: account creation and maintenance, authentication, balance management, and betting history;
• Financial processing: deposits via Pix, boleto bancário, card, PicPay, and Mercado Pago; withdrawals to the account holder's Pix key or bank account;
• Fraud and money laundering prevention: betting pattern analysis, identity verification (KYC), compliance with Brazilian financial regulations;
• Responsible gambling: monitoring of gameplay patterns that may indicate compulsive behavior, and enforcement of deposit limits and self-exclusions set by the user;
• Customer support: resolving queries, bet disputes, withdrawal issues, and verification requests;
• Marketing communications: sending information about promotions, bonuses, boosted odds, and platform updates — always with the option to unsubscribe;
• Platform improvement: usage analysis to improve the interface, performance, and features, especially for mobile access;
• Compliance with legal obligations: compliance with orders from Brazilian regulatory, judicial, or law enforcement authorities when legally required.

4. Legal Bases for Processing (LGPD)

Every data processing operation carried out by 22aa has a legal basis under the LGPD (Art. 7 and Art. 11). The main bases used are:

• Contract performance (Art. 7, V): processing necessary for the performance of the platform's service agreement — account creation, bet processing, deposits, and withdrawals;
• Compliance with a legal or regulatory obligation (Art. 7, II): identity verification required by sports betting regulations, anti-money laundering compliance (Law No. 9,613/1998), and tax obligations;
• Legitimate interest (Art. 7, IX): fraud prevention, account security analysis, service improvement — where these purposes are not overridden by the data subject's interests or rights;
• Consent (Art. 7, I): marketing communications via email and mobile. Consent may be withdrawn at any time by unsubscribing from communications or by submitting a request to support.

5. Data Sharing with Third Parties

22aa does not sell users' personal data. Sharing occurs only in the situations described below, and always under contractual controls requiring third parties to apply the same level of protection as 22aa:

5.1 Service Providers

• Payment processors: companies that process Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago transactions. They receive only the data strictly necessary to complete the transaction;
• Identity verification (KYC) providers: certified platforms that perform CPF and document verification — required for compliance with Brazilian financial regulations;
• Cloud infrastructure providers: servers and storage services used to operate the platform, all governed by contracts that include specific data protection clauses;
• Casino game providers: slots, live casino, and crash game providers receive only an anonymous user identifier, with no personally identifiable data.

5.2 Authorities and Legal Obligations

22aa may disclose personal data when: (a) required by court order, (b) demanded by a Brazilian regulatory or law enforcement authority, (c) necessary to prevent or investigate fraud or money laundering. In these situations, 22aa discloses only the minimum necessary and, where legally permitted, notifies the affected user.

6. Cookies and Tracking Technologies

22aa uses cookies and similar technologies to ensure the platform runs properly and to improve the user experience. Below are the types of cookies used:

6.1 Essential Cookies

Required for the platform's basic operation — session authentication, live bet state management, and account security. These cannot be disabled without affecting platform functionality. They do not collect information for marketing purposes.

6.2 Functional Cookies

Store user preferences — such as language, favorite sport on the home screen, and odds format (decimal or fractional). These can be disabled without any critical impact on the platform's core functionality.

6.3 Internal Analytics Cookies

Used exclusively by the 22aa team to understand how users navigate the platform — which sections receive the most traffic, where technical errors occur, and average loading times. Data is processed in an aggregated and anonymized form, with no individual identification.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent access to critical features such as login and live betting.

7. Data Security

22aa adopts appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, or improper disclosure:

• Encryption in transit: all communications between the user's browser/mobile device and 22aa's servers are protected by TLS 1.3;
• Encryption at rest: sensitive data stored — such as CPF, banking details, and Pix key — is encrypted at rest with AES-256;
• Role-based access control: only team members with a proven operational need have access to identifiable personal data — and all access is logged and auditable;
• Two-factor authentication: available to all users and mandatory for accounts with financial activity above certain thresholds;
• Continuous monitoring: anomaly detection systems monitor unusual access attempts and intrusion attempts 24 hours a day;
• Regular audits: 22aa's security infrastructure undergoes periodic assessments by independent specialized firms.

Security Incidents

In the event of an incident that compromises personal data and poses a real risk to data subjects, 22aa will notify the National Data Protection Authority (ANPD) and the affected users within the timeframe set by the LGPD, providing information on the nature of the incident, the data involved, and the measures taken to mitigate and resolve it.

8. Data Retention

22aa retains personal data for as long as necessary for each specific purpose, in accordance with the minimum retention periods required by Brazilian law:

• Registration and identity data: for as long as the account remains active. After closure, for up to 5 years to meet legal obligations and resolve any disputes;
• Financial transaction history: minimum of 5 years, as required by tax and anti-money laundering legislation;
• Betting history: 2 years after the bet is settled, for audit and dispute resolution purposes;
• Access data and security logs: 12 months for incident investigation and fraud prevention purposes;
• Support communications: 2 years after the case is closed;
• Data from accounts closed due to terms violations: indefinite period to prevent improper re-registration.

Once the above retention periods expire, data is securely deleted or irreversibly anonymized — making it impossible to link the information back to any specific individual.

9. Your Rights as a Data Subject

The LGPD grants you, as a data subject, a set of rights that may be exercised at any time by emailing privacidade@22aa.best. 22aa is committed to responding to all requests within 15 business days:

10. Minors Under 18

22aa's services are intended exclusively for users aged 18 and over. The platform does not intentionally collect personal data from minors. Registration requires a CPF, which is validated against the Brazilian Federal Revenue database — a process that includes date of birth verification.

If 22aa determines that it has collected data from a user under 18, the account will be immediately closed and all of that user's data will be deleted, except for what is needed to document the case and prevent re-registration. If you believe a minor has improperly used the platform, please contact suporte@22aa.best immediately.

11. International Data Transfers

Some of the infrastructure and service providers used by 22aa may process or store data outside Brazil — for example, on servers of cloud providers with data centers in other countries. When this occurs, 22aa ensures that:

• The transfer is made only to countries with a level of data protection deemed adequate by the ANPD, or;
• Sufficient contractual safeguards exist — such as standard contractual clauses or equivalent certifications — ensuring the data subject receives the same level of protection guaranteed by the LGPD;
• The volume of data transferred internationally is limited to the minimum strictly necessary for the operation of the specific service.

12. Marketing Communications

With your consent, 22aa may send communications about promotions, bonuses, boosted odds on Brasileirão and Copa do Brasil matches, new casino game launches, poker freerolls, and other platform updates. These messages are sent through the channels you registered — email and mobile.

How to Unsubscribe

• Click the "Unsubscribe" link included in every marketing email sent by 22aa;
• Access the notification settings in your platform account;
• Submit a request to suporte@22aa.best requesting to opt out of marketing communications.

Opting out of marketing communications does not affect the receipt of essential operational communications — such as withdrawal confirmations, account security alerts, and notifications about changes to the Terms and Conditions.

13. Data Protection Officer (DPO)

As required by the LGPD, 22aa has appointed a Data Protection Officer (DPO) responsible for:

• Receive and respond to data subjects' requests regarding their rights;
• Communicate with the National Data Protection Authority (ANPD);
• Advising the 22aa team on proper data processing practices;
• Receive security incident notifications and coordinate the necessary responses.

To contact the National Data Protection Authority (ANPD) directly, visit the official ANPD portal on the Brazilian federal government website. 22aa cooperates fully with the ANPD in any investigations or inspections.

14. Changes to This Privacy Policy

22aa may update this Privacy Policy periodically to reflect changes in legislation — especially regulations derived from the LGPD —, new platform features, changes in service providers, or improvements to data protection practices.

Any significant change will be communicated by email to the address registered on your account at least 7 days before the new terms take effect. Minor updates — such as improvements to text clarity with no change in practices — may be made without prior notice, but will always reflect a revised update date at the top of the document.

Continued use of the 22aa platform after the effective date of any changes constitutes acceptance of the new terms. If you do not agree with the changes, you may close your account before the effective date without penalty — your available real balance will be refunded via Pix.

Last updated: January 2026. For questions about this Privacy Policy, please contact privacidade@22aa.best.