Privacy Policy 78mcom — Your Data Protected by the LGPD

The platform 78mcom (available at 78mcom.best and on the official app for Android and iOS) is the controller of personal data collected during registration, use, and account closure by its members in Brazil.

For the purposes of this Privacy Policy, the following terms are used as defined under the LGPD:

• Controller: 78mcom, which determines the purposes and means of personal data processing;
• Data Subject: you — the individual to whom the personal data relates;
• Processing: any operation involving personal data, including collection, storage, use, sharing, and deletion;
• DPO (Data Protection Officer): the person designated by 78mcom to serve as the communication channel between data subjects, the company, and the National Data Protection Authority (ANPD).

78mcom collects only the data strictly necessary to deliver its services safely, legally, and efficiently. Collection takes place at different stages of your relationship with the platform:

78mcom does not collect sensitive data such as racial or ethnic origin, religious belief, political opinion, or genetic or biometric data for identification purposes — except for the document photo and selfie required by KYC, which are processed exclusively for identity verification.

Every piece of data collected by 78mcom has a specific, justified purpose. The platform never uses your data in ways that are incompatible with what is stated below:

• Account management: registration, authentication, access control, and experience personalization on the platform;
• Identity verification (KYC): confirm that you are who you claim to be, preventing fraud and unauthorized account use;
• Payment processing: process deposits via Pix, bank slip, credit/debit card, PicPay, Mercado Pago, and TED; process withdrawals to your bank account or Pix key;
• Fraud and money laundering prevention: monitoring of unusual transaction activity in accordance with financial compliance requirements;
• Customer support: resolve inquiries, process requests, and maintain support interaction history;
• Marketing communications: send promotions, news, and relevant offers by email, SMS, or push notification — only with your consent, which may be withdrawn at any time;
• Platform improvement: aggregated and anonymized usage analysis to identify improvements to the user experience;
• Compliance with legal obligations: comply with requests from competent authorities as required by court order or regulatory determination.

The LGPD requires that every processing of personal data have a specific legal basis. 78mcom relies on the following legal bases, as set out in Art. 7 of Law 13.709/2018:

• Contract performance (Art. 7, V): data required to create and maintain your account and to process bets, deposits, and withdrawals — without this data, the service cannot be provided;
• Fulfillment of legal obligation (Art. 7, II): KYC data and financial records required for compliance with anti-money laundering regulations and industry standards;
• Legitimate interest (Art. 7, IX): security data, fraud prevention, and platform usage analytics — always respecting your fundamental rights;
• Consent (Art. 7, I): marketing communications via email, SMS, and push notifications — collected at registration and revocable at any time without affecting your use of the platform.

78mcom does not sell or rent your personal data. Sharing occurs only in the following situations, all of which are necessary for the operation of the platform:

• Payment processors: PCI-DSS certified gateways that process transactions via Pix, credit/debit card, PicPay, and Mercado Pago — receiving only the data strictly required for the transaction;
• Identity verification providers: KYC platforms that perform document analysis — they operate under contract with data protection clauses and do not retain images after verification;
• Game providers: licensed providers such as Pragmatic Play, NetEnt, Evolution Gaming, Microgaming, and Playtech receive an anonymous session identifier to run the games — with no access to the member's name, CPF, or banking details;
• IT infrastructure providers: hosting and cloud computing services that store data under contracts including confidentiality and protection clauses in accordance with the LGPD;
• Government authorities: data is provided when required by court order, or upon request from the Central Bank, Federal Revenue Service, or other competent authorities, in accordance with Brazilian law.

All third parties that receive data from 78mcom members are contractually required to handle that information with the same level of protection demanded by the LGPD, and are prohibited from using it for any purpose beyond what was agreed.

78mcom applies strict technical and organizational measures to protect your personal data against unauthorized access, alteration, improper disclosure, or destruction:

• Encryption in transit: 256-bit SSL/TLS on all communications between your device and 78mcom's servers;
• Encryption at rest: personal data and KYC documents are stored encrypted on our servers — even employees without specific authorization cannot access them in plain text;
• Access control: principle of least privilege — each 78mcom team member can only access the data strictly necessary for their role;
• Two-factor authentication: available for your account and required for internal administrative access;
• Continuous monitoring: intrusion detection systems and suspicious activity alerts operate 24 hours a day;
• Secure backups: data backups are performed regularly and stored with the same level of encryption as the primary data.

In the event of a security incident that may affect your personal data, 78mcom will notify the affected data subjects and the National Data Protection Authority (ANPD) within the timeframe established by the LGPD, detailing what occurred and the measures taken.

78mcom uses cookies and similar technologies to enhance your experience on the platform. The types of cookies used are:

• Strictly necessary cookies: essential for the platform to function — they keep your session active, manage your bet slip, and ensure security. They cannot be disabled;
• Performance cookies: collect anonymous information about how you use the platform (pages visited, session duration) to identify improvements. They do not link this data to your profile;
• Functionality cookies: store your preferences (language, favorite sport, layout) to personalize your experience;
• Analytics cookies: used to measure overall platform performance in aggregate — always with anonymized data.

You can manage your cookie preferences in your browser settings. Disabling non-essential cookies may affect some platform features, but it won't prevent you from accessing your account or using the core services. 78mcom does not use third-party cookies for retargeting advertising.

The 78mcom platform is exclusively intended for users aged 18+ residing in Brazil. 78mcom does not intentionally collect personal data of individuals under 18 years of age.

Age verification is carried out at registration, with mandatory confirmation of date of birth and CPF. The KYC process confirms that the user is of legal age before the first withdrawal. If an account is found to have been created by a minor — whether through error or fraud — the account is immediately closed, any real-money balance deposited is refunded, and all data is deleted from 78mcom's systems as quickly as possible.

If you believe a person under 18 has created an account on 78mcom, please contact us immediately at contato@78mcom.best with the subject line "Minor – Urgent".

In some cases, personal data of 78mcom members may be transferred to or processed outside Brazil — particularly by cloud computing infrastructure providers and international game providers (such as Microgaming, NetEnt, Playtech, and Evolution Gaming).

When this occurs, 78mcom ensures the transfer is covered by one of the safeguards provided under the LGPD:

• Transfer to countries with an adequate level of protection recognized by the ANPD;
• Standard contractual clauses requiring the recipient to implement data protection measures equivalent to those under the LGPD;
• Specific consent from the data subject, where applicable.

International game providers that access session data from Brazilian 78mcom members receive only anonymized identifiers — with no access to names, CPF numbers, banking details, or KYC documents.

The LGPD grants you, as a data subject, the following rights regarding information processed by 78mcom:

• Access (Art. 18, I and II): confirm whether your data is being processed and access the personal data 78mcom holds about you;
• Rectification (Art. 18, III): request the correction of incomplete, inaccurate, or outdated data;
• Anonymization or Erasure (Art. 18, IV): for data that is unnecessary, excessive, or processed in violation of the LGPD;
• Portability (Art. 18, V): receive your data in a structured format for transfer to another controller, where technically feasible;
• Erasure (Art. 18, VI): request the deletion of data processed on the basis of consent — subject to legally mandated retention periods;
• Information on Sharing (Art. 18, VII): know which public or private entities your data has been shared with;
• Withdrawal of consent (Art. 18, IX): withdraw consent for marketing communications at any time, at no cost;
• Objection (Art. 18, § 2º): object to processing based on legitimate interest that infringes your fundamental rights.

78mcom retains personal data for the shortest period necessary to fulfill the purposes for which it was collected. Retention periods are:

Once the retention periods above have expired, data is securely deleted or irreversibly anonymized, making any future link to your identity impossible.

78mcom may periodically update this Privacy Policy to reflect changes in legislation, data processing practices, or the services offered. Material changes will be communicated via:

• Email notification sent to the address registered on your account;
• Push notification via the official 78mcom app;
• A prominent notice posted on the site at least 15 calendar days before the changes take effect.

Continued use of the platform after the effective date of any changes constitutes implicit acceptance of the updated Policy. If you do not agree with the changes, you may close your account before the effective date and request deletion of your data.