Privacy Policy of 998h – How We Protect Your Data

The 998h is the online entertainment platform responsible for processing the personal data described in this policy. For the purposes of the LGPD, the 998h is the controller of the data — meaning it decides the purposes and means of processing the personal information of data subjects.

The 998h may use third-party data processors — companies that process data on behalf of the platform under contractually defined instructions — for services such as payment processing (Pix, boleto, card), game providers (Evolution Gaming, Pragmatic Play, PG Soft, among others), and technology infrastructure. These partners are selected based on their compliance with data protection standards and are subject to confidentiality agreements.

To contact the controller regarding privacy matters, use the email suporte@998h.best with the subject line "Privacy – LGPD".

The 998h collects different categories of data depending on the stage of your interaction with the platform. The categories and specific data points for each stage are detailed below:

Registration data (provided by you):

• Full name as shown on government-issued ID;
• CPF (Individual Taxpayer Registration);
• Date of birth;
• Full residential address (street, number, unit, neighborhood, city, state, ZIP code);
• Email address;
• Mobile phone number with area code;
• Access password (stored exclusively as a cryptographic hash, never in plain text).

Identity verification (KYC) data:

• Scanned copy of a government-issued photo ID (RG or CNH, front and back);
• Proof of address (utility bill for water, electricity, or gas, or a bank statement issued within the last 90 days);
• Selfie holding the document, when requested by the security system;
• Additional documents that may be requested to fulfill compliance obligations.

Financial data:

• Full history of deposits and withdrawals made on the platform;
• Pix keys used for transactions (CPF, email, phone number, or random key);
• Credit/debit card information processed by the payment gateway (998h does not store full card numbers);
• Transaction records via boleto bancário, PicPay, and Mercado Pago.

Platform usage data (collected automatically):

• IP address and approximate location;
• Device type, operating system, and browser used;
• Browsing history within the 998h platform;
• Game history, bets, winnings, and losses;
• Date, time, and duration of gaming sessions;
• Cookie data and session identifiers (detailed in Section 5).

The 998h uses the personal data collected solely for the purposes listed below. No processing takes place outside these purposes without renewed explicit consent where applicable:

The 998h may use aggregated and anonymized data (with no possibility of individual identification) for statistical analysis, platform improvement, and internal reporting. Such anonymized data does not qualify as personal data under the LGPD and may be freely used for analytical purposes.

The 998h does not sell, rent, or transfer your personal data to third parties for marketing purposes or for those third parties' own commercial use. Data sharing occurs only in the situations described below, always on an appropriate legal basis:

• Game providers: Evolution Gaming, Pragmatic Play, PG Soft, Spribe, and other partners receive session identifiers required to connect you to your chosen table or game. These providers do not receive your full name, CPF, or financial details;
• Payment processors: Financial institutions and payment gateways (Pix partners, card acquirers, PicPay, Mercado Pago) receive only the data strictly necessary to process each transaction, in accordance with their own privacy policies;
• KYC tools: Identity verification partners who process documents to confirm member eligibility. These partners are contractually bound not to use the data for any other purpose;
• Competent authorities: In compliance with Brazilian law, 998h may provide data to authorities when legally required, such as in money laundering investigations or pursuant to a court order;
• Technology infrastructure: Server and cloud service providers that store and process data according to 998h's instructions, under data processing agreements that ensure compliance with the LGPD.

The 998h uses cookies and similar technologies to ensure the platform functions correctly, personalize your experience, and analyze site usage. The cookie categories used are outlined below:

• Essential Cookies: Required for the platform's basic operation. These include authentication cookies (which keep you logged in), game session cookies, and security cookies (such as anti-CSRF tokens). They cannot be disabled without affecting platform functionality;
• Functional cookies: Store user preferences such as language, interface settings, and recent game history. They improve the experience without collecting data for marketing purposes;
• Analytical cookies: Collect aggregated data on how users interact with the platform (pages visited, session time, error rate). Data is anonymized and used to improve 998h;
• Responsible gambling cookies: Track session time and usage patterns to trigger responsible gambling alerts configured by the user in the account dashboard.

You can manage cookies in your browser settings. Disabling essential cookies will affect the proper functioning of your account. For questions about specific cookies used by the 998h, please contact support.

The 998h implements appropriate technical and organizational measures to protect members' personal data against unauthorized access, alteration, disclosure, or destruction. The main security measures include:

• 256-bit SSL/TLS Encryption across all data transmissions between the user's device and 998h's servers;
• Passwords stored as hashes using secure hashing algorithms (bcrypt). 998h never stores passwords in plain text, and no staff member has access to any account's password;
• Role-based access control (RBAC) to systems containing personal data. Only staff with a legitimate need are granted access, and that access is recorded in audit logs;
• Continuous monitoring of suspicious activity across systems, with automatic alerts sent to the security team;
• Incident response plan documented. In the event of a data breach that may pose a risk to data subjects, 998h notifies the Autoridade Nacional de Proteção de Dados (ANPD) within the legal deadline and informs the affected data subjects;
• Encrypted backups and system redundancy to ensure data availability and integrity.

Despite all measures in place, no system is 100% immune to threats. If you suspect your account has been compromised, contact 998h via live chat for preventive account blocking.

The 998h retains members' personal data for as long as needed to fulfill the purposes for which it was collected, in compliance with mandatory legal retention periods. The main retention periods are:

• Registration data and active account: Retained for as long as the account is active or until you request its closure;
• Financial and transaction data: Retained for a minimum of 5 (five) years after the last transaction, in accordance with financial compliance requirements and Brazilian anti-money laundering legislation (Law No. 9.613/1998);
• KYC documents: Retained for 5 (five) years after account closure, in accordance with regulatory requirements;
• Customer support data: Chat history retained for 2 (two) years for dispute resolution purposes;
• Security logs: Kept for 1 (one) year for audit and incident investigation purposes.

Once the applicable retention period expires, data is securely deleted or irreversibly anonymized. You may request early deletion of your personal data — the request will be fulfilled in cases where no legal retention obligation prevents it.

The LGPD grants you, as the holder of personal data processed by the 998h, the following rights, which may be exercised at any time:

The platform 998h is strictly intended for individuals aged 18 and over. The 998h does not intentionally collect personal data from individuals under 18 years of age and does not permit registration or use of its services by that age group.

If the 998h identifies that data belonging to a minor under 18 has been inadvertently collected, the following immediate steps will be taken:

• Immediate suspension of the associated account;
• Deletion of all the minor's personal data from the platform's systems;
• Notification of the legal guardian, where identifiable;
• Reversal of any financial transactions carried out through the account.

If you become aware that a minor under 18 has created an account on 998h, please contact support immediately at suporte@998h.best immediately so that the necessary steps can be taken.

The 998h may update this Privacy Policy periodically to reflect changes in data processing practices, updates to applicable legislation, or improvements to the platform. The date of the last update is always shown at the top of this page.

When changes are material to your rights or to the way your data is handled, the 998h will notify members via their registered email at least 7 (seven) days before the updated version takes effect. Continued use of the platform after the effective date of the updated version constitutes acceptance of the new terms.

Previous versions of this Privacy Policy may be requested from support via a formal email request and will be made available within 5 business days.

The 998h has appointed a Data Protection Officer (DPO) as required by the LGPD for controllers that process personal data at scale. The DPO serves as the official point of contact between 998h, data subjects, and Brazil's National Data Protection Authority (ANPD).

To contact the DPO of 998h:

• Email: suporte@998h.best with the subject line "DPO – Privacy";
• Live chat: Available 24/7 on the account dashboard after login by requesting to speak with the privacy team;
• Response time: Up to 15 business days for matters related to the LGPD.

If you believe that the processing of your data by the 998h violates the LGPD and you do not receive a satisfactory response within the legal deadline, you have the right to file a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD), pursuant to art. 18, § 1º, of Law No. 13.709/2018.