39ss1 Privacy Policy – How We Protect Your Data

1. Data Controller and Scope of This Policy

The 39ss1 — operator of the Sports Betting and online casino platform available at 39ss1.best — acts as the data controller for personal data processed under this Privacy Policy, in accordance with the General Data Protection Law (LGPD – Law No. 13,709/2018). This Policy applies to all personal data collected when you access the site, create an account, place bets, deposit or withdraw funds, or interact with any feature of the platform.

This Policy applies to all users of the 39ss1 residents in Brazil. If you access the platform from another country where online betting is regulated differently, the provisions of this policy still apply to the data processing carried out by 39ss1 as data controller. For specific privacy inquiries, please contact us at suporte@39ss1.best.

2. What Personal Data We Collect

The 39ss1 collects different categories of data depending on how you interact with the platform. Below is an organized overview by data type:

2.1 Data you provide during registration

• Full name as shown on identity document
• CPF (Individual Taxpayer Registry)
• Date of birth
• Email address
• Mobile number (optional, but recommended for 2FA)
• Full residential address (collected during KYC verification)

2.2 Identity verification data (KYC)

• Government-issued ID image (RG, CNH, or passport)
• Proof of residence issued within the last 90 days
• Selfie with ID document (for advanced verification cases)

2.3 Financial transaction data

• Pix key, bank slip details, or tokenized card information
• Deposit and withdrawal history in BRL (R$)
• Bank account ownership verification for withdrawal validation

2.4 Platform Usage Data

• Betting history, casino games, and markets accessed
• IP address and approximate location via network geolocation
• Browser type and version, operating system, and device
• Session duration, pages visited, and interactions with the interface
• Access logs for security and fraud prevention purposes

3. Purposes of Data Processing

Each piece of data collected by the 39ss1 has a specific, declared purpose. We do not process data for purposes beyond those listed below without informing you and, where required, obtaining fresh consent.

4. Legal Basis for Processing (LGPD)

The 39ss1 processes personal data only on the basis of one of the legal grounds established under the LGPD. The main grounds we rely on are:

• Contract performance (art. 7, V): when processing is necessary to fulfill the service agreement, such as processing your Pix withdrawals or keeping your account active.
• Legal or regulatory obligation (art. 7, II): when the law requires processing, such as anti-money laundering regulations (Law No. 9.613/1998) and mandatory identity verification for operators in the sector.
• Legitimate interest (art. 7, IX): for purposes such as fraud prevention, platform security, and product improvement, always respecting users' rights and interests.
• Consent (Art. 7, I): for sending marketing communications and advanced content personalization. You may withdraw this consent at any time.

5. Data Sharing with Third Parties

The 39ss1 does not sell personal data. We share information only when necessary to operate the service or meet legal obligations, with the following categories of recipients:

5.1 Payment Providers

To process deposits and withdrawals, we share the necessary data with Pix, boleto bancário, credit and debit card, PicPay, and Mercado Pago infrastructure providers. These providers act as data operators under contract with 39ss1 and are subject to the same data protection obligations.

5.2 Casino Game Providers

To provide live casino games, slots, and crash games, we share an anonymous user identifier (not your CPF or banking details) with licensed game providers. This sharing is necessary for live tables to function and for game history to be recorded.

5.3 Competent Authorities

The 39ss1 cooperates with the Ministry of Finance, COAF (Financial Activities Control Council), the Federal Revenue Service, and other competent Brazilian authorities when there is a legal obligation to provide information or when an investigation involves unlawful activity by platform users.

5.4 Analytics and Security Services

We use traffic analysis and security monitoring tools that may collect usage data in an aggregated and anonymized form. This data cannot be used to identify individual users and is used exclusively to improve platform stability and performance.

6. International Data Transfers

Some technology providers that 39ss1 uses — such as cloud infrastructure and casino game providers — may be located outside Brazil. When this occurs, we ensure that international transfers take place only to countries or organizations offering a level of protection equivalent to the LGPD, or through the adoption of standard contractual data protection clauses.

Your financial data and identity documents are preferably stored on servers located in Brazil or in countries whose data protection legislation has been recognized as adequate by the National Data Protection Authority (ANPD). For more information about specific international transfers, please contact the privacy email of the 39ss1.

7. Data Retention and Deletion

The 39ss1 retains personal data for as long as necessary to fulfil the purposes for which it was collected, respecting the minimum retention periods required by law:

• Active account data: retained for as long as the account is active and for the period required after closure to meet legal obligations.
• Financial and transaction data: retained for a minimum of 5 years after each transaction, as required by anti-money laundering regulations and the Receita Federal.
• KYC data (documents): retained for a minimum of 5 years after account closure, in accordance with the regulatory obligation applicable to the sector.
• Access and security logs: retained for 6 months to 1 year, in accordance with the Brazilian Internet Act (Law No. 12,965/2014).
• Marketing data (with consent): retained for as long as consent has not been withdrawn. After withdrawal, data is removed from communication lists within 10 business days.

Once the applicable retention periods have expired, data is anonymized or securely deleted, ensuring it cannot be recovered or linked to any identifiable user.

8. Data Security

The 39ss1 implements technical and organizational measures proportionate to the risks involved in processing bettors' personal data. The key measures currently in place include:

• SSL/TLS 256-bit Encryption on all connections between the user's browser and the platform's servers.
• Encrypted storage of passwords using one-way hashing algorithms — not even the internal team at 39ss1 has access to your password in plain text.
• Two-Factor Authentication (2FA) available to all users and mandatory for withdrawal transactions above a certain amount.
• Restricted access controls to internal systems, with a full audit log of all operations performed by staff on user data.
• Real-time anti-fraud monitoring, with automatic alerts for suspicious access patterns.
• Regular security testing, including vulnerability assessments and penetration testing carried out by specialized teams.

In the event of a security incident that may affect your personal data, 39ss1 will notify the National Data Protection Authority (ANPD) and affected users within 72 hours of confirming an incident, as required by the LGPD. The notification will include the nature of the incident, the data involved, and the measures taken to mitigate the impact.

9. Cookies and Tracking Technologies

The 39ss1 uses cookies and similar technologies to ensure the platform functions correctly, analyze performance, and personalize the betting experience. See the types of cookies we use:

9.1 Strictly Necessary Cookies

These are essential for the platform to function. They include the authenticated session cookie (which keeps you logged in while browsing), the language preference cookie, and security cookies that identify your session. These cookies cannot be disabled without affecting your ability to use the platform.

9.2 Performance & Analytics Cookies

Collect information about how users navigate the platform — which pages they visit most often, how long they spend in each section, and which features they use. The data is aggregated and anonymized, never identifying individual users. It is used exclusively to improve 39ss1.

9.3 Functionality Cookies

They remember your platform preferences, such as odds displayed in decimal or fractional format, favorite sports on the homepage, and bet slip settings. They improve your experience without tracking your activity outside the site.

9.4 Cookie Management

You can configure your browser to block or delete cookies at any time. Disabling non-essential cookies does not affect access to the platform's core features, but may reduce personalization. Cookie management steps vary by browser — check the settings in Chrome, Safari, Firefox, or Edge for more details.

10. Minors

The services of 39ss1 are intended exclusively for users aged 18 and over. The platform does not knowingly collect personal data from minors. If we identify that an account was created by a minor, that account will be immediately closed, the data will be deleted, and any balance will be returned to the verified legal guardian.

If you become aware that a minor is using the platform, please notify us immediately at suporte@39ss1.best or through our 24-hour support chat. The identity verification (KYC) carried out at the time of the first withdrawal is one of the protection layers that 39ss1 uses to ensure that only users aged 18 and over can access its services.

11. Your Rights as a Data Subject (LGPD)

The LGPD grants you, as a personal data subject, a set of rights that 39ss1 is committed to respecting and facilitating the exercise of. Here are those rights and how to exercise them:

• Access: request a copy of all personal data that 39ss1 holds about you.
• Correction: request the correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion: request that unnecessary data, or data processed in violation of the LGPD, be anonymized, blocked, or deleted.
• Portability: request the transfer of your data to another service provider, in a structured and interoperable format.
• Deletion upon consent withdrawal: where processing is based on consent, you may withdraw it at any time and request the deletion of the related data.
• Sharing information: find out which third parties 39ss1 shares your data.
• Objection: object to processing carried out on the basis of legitimate interest, if you believe your rights outweigh the platform's interest.
• Review of automated decisions: request human review of decisions made by an automated system that affect your interests — such as an account block triggered by the anti-fraud system.

To exercise any of these rights, contact us at suporte@39ss1.best with the subject line "LGPD Rights – [your right]". 39ss1 39ss1 will respond within 15 business days and may request additional documentation to verify your identity before processing the request.

12. Marketing Communications and Opt-Out

The 39ss1 may send communications by email and SMS about promotions, enhanced odds for Brasileirão or Copa do Brasil matches, platform updates, and personalized offers based on your betting history. These communications are only sent when you have given explicit consent — either at registration or later through your account settings.

You can unsubscribe from marketing communications at any time in three ways: by clicking the "unsubscribe" link in any email sent by 39ss1; by accessing the notification settings in your account; or by emailing suporte@39ss1.best with the subject line "Opt-out marketing". Opt-out requests are processed within 10 business days. Communications strictly related to your account's operation — such as withdrawal confirmations, security alerts, or KYC verification notices — will continue to be sent regardless of your marketing preferences.

13. Changes to This Privacy Policy

The 39ss1 may update this Privacy Policy periodically, particularly in response to changes in Brazilian data protection legislation, new ANPD guidelines, updates to the services offered, or changes in data processing practices. When material changes are made, you will be notified by email at your registered address at least 15 days before the new rules take effect.

The date of the last update to this Policy appears at the top of this document. We recommend reviewing this page periodically to stay informed. Continued use of the platform after the effective date of the updated version constitutes acceptance of the changes. If you disagree with the changes, you may close your account before the effective date and receive your available real balance at no cost.

14. Contact and Data Protection Officer (DPO)

The 39ss1 has appointed a Data Protection Officer (DPO), as required by the LGPD for companies that process personal data at scale. The DPO is responsible for ensuring the platform complies with the LGPD and for handling data subject requests.

To exercise your rights, clarify any questions about this Policy, or report any privacy-related concern at 39ss1, use the following channels:

• Privacy email: suporte@39ss1.best (subject: "Privacy / LGPD")
• Support chat: available 24 hours a day directly on the platform
• Response timeframe: up to 15 business days for LGPD-related requests