14win Privacy Policy – Data Protection and LGPD

1 General Provisions

This Privacy Policy describes how the platform 14win ("14win", "we", "our"), accessible at 14win.best, collects, uses, stores and protects users' personal information ("you", "data subject") in accordance with the General Data Protection Law (Law No. 13,709/2018 — LGPD) and other regulations applicable to the Brazilian market.

14win is a Sports Betting, live casino, and online entertainment platform aimed exclusively at the Brazilian market, operating with payments in BRL via methods such as Pix, bank slips, credit/debit cards, PicPay, Mercado Pago, and TED transfers. All operations and data processing described in this Policy take place within Brazilian territory or with adequate safeguards when international infrastructure is involved.

By creating an account or using any 14win service, you confirm that you have read and understood this Privacy Policy. If you disagree with any aspect of it, we recommend that you do not use the platform and contact support for guidance on closing your account.

2 Data Collected

2.1 Data provided directly by you

When you create an account, carry out transactions, or contact 14win support, we collect the following categories of data:

2.2 Automatically collected data

While you use the platform, 14win automatically collects technical and behavioral data necessary to operate the service securely:

• Device data: device type, operating system, browser, app version, and device identifiers;
• Connection data: IP address, approximate geographic location (city/state), internet service provider, and access time;
• Usage data: pages visited, categories accessed, bets placed, session duration, and interface interactions;
• Transaction data: complete history of deposits, withdrawals, bets, winnings, and losses on the platform;
• Cookies and similar technologies: detailed in Section 9 of this Policy.

3 Third-Party Data and External Sources

In certain situations, 14win may receive information about you from third parties, always through legitimate means and with an appropriate legal basis:

• Payment processors: when you make a deposit via Pix, bank slip, credit/debit card, PicPay, or Mercado Pago, we receive transaction confirmation data, including status and identification details required to reconcile the payment with your account;
• Identity verification services: for the KYC process required by Brazilian betting regulations, we may use official database lookup services to validate the information you provide;
• Public authorities: in compliance with court orders or requests from regulatory authorities, we may receive or be required to provide information as determined by Brazilian law;
• Restriction lists: we consult lists of individuals prohibited from participating in betting (such as self-exclusion programs and identified underage person lists) to fulfill our responsible gambling obligations.

4 Purposes of Processing

Each piece of data collected by 14win has a specific purpose and a corresponding legal basis under the LGPD. We do not process data for purposes incompatible with those described below:

• Account management and service delivery: maintain your active account, process bets, settle results, and manage your activity history. Legal basis: performance of contract (Art. 7, V, LGPD);
• Processing of financial transactions: process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED; reconcile payments and issue receipts. Legal basis: contract performance and compliance with a legal obligation;
• Identity verification (KYC): comply with legal requirements for identity, age, and source-of-funds verification under Law No. 14.790/2023 and Central Bank regulations. Legal basis: compliance with a legal obligation (Art. 7, II, LGPD);
• Fraud prevention and security: detect and prevent unauthorized access, use of multiple accounts, money laundering, and other unlawful activities. Legal basis: legitimate interest and compliance with a legal obligation;
• User support: answering questions, resolving issues with tickets or payments, and keeping a support history log. Legal basis: performance of a contract;
• Responsible gambling: monitor gambling patterns that may indicate problematic behavior and offer control tools in line with regulatory requirements. Legal basis: compliance with a legal obligation and legitimate interest;
• Service communications: send notifications about transactions, betting results, account updates, and essential operational communications. Legal basis: performance of contract;
• Experience personalization: tailor the display of odds, markets, and content based on your usage history, with the goal of improving platform relevance for you. Legal basis: legitimate interest (with opt-out option);
• Marketing communications: send information about promotions, new features, and special events — only with your explicit consent, which may be revoked at any time. Legal basis: consent (Art. 7, I, LGPD).

5 Data Sharing

5.1 Who we share data with

14win may share your data with the following categories of third parties, always with an appropriate legal basis and limited to the minimum necessary for the stated purpose:

• Payment processors: financial institutions and payment platforms used to process deposits and withdrawals — Pix (via partner banks such as Nubank, Itaú, Bradesco, Banco do Brasil, and others), PicPay, Mercado Pago, and boleto bancário issuers;
• Technology service providers: companies providing cloud infrastructure, cybersecurity, data processing, and platform performance analysis services, always under contracts that include data protection clauses;
• Identity verification services: KYC service providers used to meet regulatory obligations, with access restricted to the data strictly necessary for the verification process;
• Public and regulatory authorities: when required by law, court order, or request from a competent Brazilian regulatory body — such as the Ministry of Finance, Receita Federal, COAF, or public security authorities;
• Auditors and legal advisors: professionals providing audit, compliance, or legal advisory services to 14win, under a confidentiality obligation.

5.2 What we never do

6 Data Security

14win implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure. Key measures include:

• Encryption in transit: all communications between your device and the platform use TLS (Transport Layer Security) with valid certificates, ensuring that transmitted data cannot be intercepted in plain text;
• Encryption at rest: sensitive data stored on 14win servers — including verification documents, financial data, and authentication information — is encrypted at rest using robust algorithms;
• Access controls: internal access to user data is restricted by the principle of least privilege — only staff with a legitimate operational need may access specific data, always with multi-factor authentication;
• Continuous monitoring: automated systems monitor the platform in real time to detect anomalous activity, intrusion attempts and suspicious access patterns;
• Security testing: the platform undergoes periodic security assessments, including penetration tests carried out by specialized teams;
• Password policy: user passwords are stored in hashed and salted format, never as plain text. If a compromise is suspected, the system forces an immediate password reset.

7 Data Retention and Deletion

14win retains your personal data for as long as necessary for the purposes described in this Policy, observing the minimum retention periods required by Brazilian law:

• Active account data: retained for the entire period the account is active and for up to 5 years after closure, in accordance with tax and anti-money laundering requirements;
• Financial records: deposits, withdrawals, and transaction history are retained for at least 5 years after each transaction, in accordance with the National Tax Code and related legislation;
• KYC documents: identity verification documents are retained for the regulatory period applicable to betting operations, generally 5 years;
• Support communications: support history retained for 2 years after the last interaction, for quality assurance and dispute resolution purposes;
• Marketing and consent data: retained for as long as consent is active and for up to 1 year after revocation, for the purpose of evidencing the legal basis.

Once the applicable retention period expires, data is anonymized or securely deleted. Anonymization makes data irreversibly dissociated from any identifiable individual, allowing its use for statistical purposes and platform improvement.

8 How to Exercise Your Rights

To exercise any of the rights guaranteed by the LGPD, you may contact 14win through the following channels:

• Platform chat: available 24 hours a day, 7 days a week, directly on the platform after login;
• WhatsApp: number available in the account dashboard after login;
• Email: suporte@14win.best — for formal rights-exercise requests, with a response within 15 business days.

For requests involving access, portability, or deletion of data, we may need to verify your identity before processing, to ensure that data is delivered to the correct data subject. This process is quick and uses the verification details already registered on the account.

If you believe your request was not handled appropriately or that your rights are being violated, you may file a complaint directly with the National Data Protection Authority (ANPD), through the gov.br/anpd portal.

9 Cookies and Tracking Technologies

9.1 What cookies are and how we use them

Cookies are small text files stored on your device when you access the 14win platform. We use cookies for the following purposes:

• Essential cookies: required to keep your session active, authenticate your login and ensure the platform's basic functionality. Without these cookies, you cannot access your account or place bets. They cannot be disabled;
• Performance cookies: collect information about how you use the platform — which pages you visit most often, how long you spend in each section, and whether you encounter error messages — to help improve the experience. Data is aggregated and does not identify you individually;
• Functionality cookies: remember your usage preferences, such as language, favorite category, and display settings, so you don't have to reconfigure them on every visit;
• Analytical cookies: used to understand platform usage patterns at an aggregate level, supporting product and development decisions. The data does not include personally identifiable information.

9.2 How to manage cookies

You can manage non-essential cookie preferences through your browser settings (Chrome, Firefox, Safari, Edge, and others allow you to control cookies on a per-site basis). Disabling performance and functionality cookies may affect non-critical aspects of your experience on the platform, but will not prevent basic access to the service.

10 Minors

The 14win platform is strictly prohibited for users under 18. We do not intentionally collect data from minors. If we identify that an account was created by a minor, the account will be closed immediately and any collected data will be deleted — except to the extent required for legal purposes related to the incident.

Parents or guardians who identify platform use by a minor should contact 14win support immediately for further action. 14win cooperates with competent authorities in any situation involving minors.

11 International Data Transfers

Part of the technology infrastructure used by 14win may be located outside Brazil — with cloud service providers whose data centers are in other countries. When this occurs, 14win ensures that international transfers of personal data are carried out with the appropriate safeguards required by the LGPD, including:

• Transfer to countries with a level of protection recognized as adequate by the ANPD;
• Standard data protection contractual clauses incorporated into agreements with international suppliers;
• Compliance certifications and security audits from the infrastructure providers we use.

Under no circumstances is personal data from 14win's Brazilian users transferred for purposes unrelated to platform operations or without an adequate legal basis.

12 Updates to this Policy

14win may update this Privacy Policy periodically to reflect changes in legislation, our data processing practices, or our services. Significant changes will be communicated to you via:

• Account dashboard notification at least 7 days in advance;
• Email to the address registered on the account;
• Update of the "last updated" date at the top of this page.

Continued use of the platform after changes take effect constitutes acceptance of the new terms. If you disagree with any change, you may exercise your right to close your account as described in the 14win Terms and Conditions, available at Terms and Conditions.

This Policy has been in effect since January 1, 2026, and supersedes all previous versions. For any questions about privacy and data protection at 14win, contact us via the platform chat, WhatsApp, or by email at suporte@14win.best.