Privacy Policy of 56xcom — How We Protect Your Data

1 Who We Are — Data Controller

The 56xcom, operator of the platform available at 56xcom.best, is the controller of the personal data collected on this site, as defined by the General Data Protection Law (LGPD — Law No. 13.709/2018). This means 56xcom is responsible for decisions about how and why your personal data is processed.

56xcom is a Sports Betting and online casino platform built exclusively for the Brazilian market. All services — football, volleyball, basketball, e-sports, slots, Live Casino, Blackjack, and crash games — are designed for users based in Brazil, with financial operations conducted exclusively in BRL (R$) and 100% Brazilian payment methods.

To exercise your rights or reach out about privacy matters, use the dedicated data protection officer (DPO) channel: privacidade@56xcom.best or general support at suporte@56xcom.best.

2 Data We Collect

The 56xcom collects personal data at various points during your use of the platform. The categories of data collected are:

Data you provide directly:

• Full name, CPF, date of birth, and nationality;
• Email address and mobile phone number;
• Full residential address (street, number, unit, neighborhood, city, state, and zip code);
• Identity documents (RG, CNH, or passport) submitted for KYC verification;
• Payment method data: Pix key, credit/debit card details (tokenized), bank details for wire transfers;
• Selfie and photo ID, when requested for identity verification.

Automatically collected data:

• IP address and approximate geolocation data;
• Browser type and version, operating system, and device used;
• Pages visited, access times, and session duration;
• Betting history, games accessed, and transactions carried out on the platform;
• Cookie data and similar tracking technologies (detailed in section 6).

The 56xcom does not collect sensitive personal data such as racial origin, religious belief, genetic or biometric data, or health information, except when strictly required to meet legal obligations and with your express consent.

3 How We Use Your Data

The personal data collected by 56xcom are used exclusively for the following purposes:

• Account creation and management: verify your identity, keep your account active and secure, and grant access to the platform;
• Processing financial transactions: process deposits via Pix, boleto bancário, credit/debit card, PicPay, Mercado Pago, and TED transfers, as well as process withdrawal requests;
• Legal and regulatory compliance: comply with obligations under Brazilian law, including anti-money laundering regulations (Law 9.613/1998), age verification, and responses to competent authorities;
• Fraud prevention and security: detect suspicious activity, prevent misuse of the platform, and protect the interests of other users;
• Experience personalization: tailor game and Sports Betting recommendations to your usage profile, when you have authorized such use;
• Communication and support: answer questions, send transactional notifications (deposit confirmation, withdrawal approved), and, with your consent, communications about 56xcom promotions and updates;
• Platform improvement: analyze aggregated and anonymized usage patterns to improve the interface, stability, and services offered.

The 56xcom does not use your data to make exclusively automated decisions that produce significant legal effects on you without the possibility of human review.

4 Legal Basis for Data Processing

All personal data processing carried out by 56xcom has a legal basis under the LGPD. The main bases applied are:

• Contract performance (art. 7, V of the LGPD): processing required to deliver the contracted services — registration, deposits, bets, and withdrawals;
• Compliance with a legal obligation (LGPD, Art. 7, II): data required by law, such as CPF for tax purposes, documents for KYC verification, and records for anti-money laundering compliance;
• Legitimate interest (art. 7, IX of the LGPD): fraud prevention, security analysis, and service improvement, provided these activities do not infringe on your fundamental rights and freedoms;
• Consent (LGPD, Art. 7, I): for sending promotional communications and personalizing your experience based on your profile. You may withdraw this consent at any time without affecting your access to the platform's core services.

When the legal basis is consent, 56xcom will request your authorization in a clear and separate manner before any processing begins. Refusing or withdrawing consent for non-essential purposes will not affect how your account functions.

5 Data Sharing with Third Parties

The 56xcom does not sell your personal data to any company or individual. Information is only shared in the following cases and always with appropriate safeguards:

• Service providers (processors): companies acting on behalf of 56xcom to process payments (payment gateways), verify identity (KYC bureaus), host data (certified cloud servers), and provide technical support. All processors are contractually required to handle your data in accordance with this Policy and the LGPD;
• Game providers: Evolution Gaming, Pragmatic Play, NetEnt, Play'n GO, PG Soft, and other content providers receive the minimum technical data required to operate the games (session identifier, available balance). No sensitive identifying data is shared unless strictly necessary;
• Authorities and regulatory bodies: when required by law, court order, administrative ruling, or for cooperation with financial crime investigations (Bacen, Receita Federal, Polícia Federal, Ministério Público);
• Fraud prevention: information may be shared with fraud prevention entities and industry exclusion lists on a strictly necessary and, where possible, anonymized basis.

Under no circumstances will 56xcom will share your data with third-party marketing companies, brokers, insurers, or any entity not directly involved in providing the platform's services, without your express consent.

6 Cookies & Tracking Technologies

The 56xcom uses cookies and similar technologies to ensure the platform works correctly and to analyze usage patterns. The types of cookies used are:

• Essential cookies: required for the platform's basic operation — maintaining your login session, processing bets, and running the deposit flow. These cannot be disabled without breaking core functionality;
• Analytical cookies: collect information about how users navigate the platform (pages visited, time spent, traffic source) in an aggregated and, where possible, anonymized form. They help improve the overall experience;
• Preference cookies: store your language, display, and game filter preferences to make your browsing experience more convenient;
• Security cookies: detect suspicious login attempts, automated activity, and other security risks.

You can manage your cookie preferences through your browser settings. Disabling essential cookies may prevent the platform from functioning properly. Analytical and preference cookies can be declined without affecting the main features of 56xcom.

The platform does not use third-party tracking cookies for advertising purposes without your explicit consent.

7 Information Security

The 56xcom implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, alteration, or improper disclosure. The main measures in place include:

• 256-bit SSL/TLS encryption across all communication between your device and the platform's servers — the same standard used by Brazilian digital banks such as Nubank, Itaú, and Bradesco;
• Secure password storage: your password is never stored in plain text — we use modern hashing algorithms with cryptographic salting;
• Payment data tokenization: your credit/debit card details are not stored directly on 56xcom's servers; instead, they are tokenized by the PCI-DSS certified payment gateway;
• Restricted access controls: only staff with a legitimate need to access user information are granted permission, and all undergo regular information security training;
• Continuous monitoring: automated systems monitor suspicious activity around the clock, with real-time alerts sent to the security team whenever anomalies are detected;
• Regular audits: the platform undergoes periodic security audits conducted by independent firms.

In the event of a security incident that may affect your personal data, 56xcom will notify the National Data Protection Authority (ANPD) and affected data subjects within the timeframes set out in the LGPD, with clear information about what occurred and the measures taken.

8 How Long We Retain Your Data

The 56xcom retains your personal data only for as long as necessary for the purposes for which it was collected, subject to mandatory legal retention periods. The general retention criteria are:

• Active account data: retained for as long as your account is active and for as long as necessary to fulfill the purposes described in this Policy;
• Financial transaction data: retained for a minimum of 5 (five) years after the transaction is completed, as required by tax legislation and anti-money laundering regulations;
• Identity verification data (KYC): retained for a minimum of 5 (five) years following account closure, in accordance with financial sector regulations;
• Bet and gaming activity records: retained for a minimum of 3 (three) years for audit and dispute resolution purposes;
• Closed account data: after voluntary account closure, essential data is retained for the minimum legally required periods and then irreversibly deleted or anonymized.

Once the applicable retention periods have expired, 56xcom carries out secure deletion or anonymization of data so that the data subject can no longer be identified.

9 Your Rights as a Data Subject

The LGPD grants you, as a data subject, the following rights regarding the information processed by 56xcom:

• Access: request a copy of all personal data we hold about you;
• Correction: request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: request that data which is unnecessary, excessive, or processed in violation of the LGPD be anonymized, blocked, or deleted;
• Portability: request the transfer of your data to another service provider in a machine-readable format, as set out in ANPD regulations;
• Deletion of data processed under consent: request the deletion of data collected solely on the basis of your consent, except where retention is required by law;
• Sharing information: obtain information about which public or private entities 56xcom has shared your data with;
• Withdrawal of consent: withdraw consent for processing based on that legal basis at any time, without affecting the continuity of essential services;
• Objection: object to processing carried out on the basis of legitimate interest that is not essential to the provision of the service;
• Review of automated decisions: request human review of decisions made solely through automated processing that affect your interests.

To exercise any of these rights, submit a request to our data protection officer at privacidade@56xcom.best or via the platform's live chat. Requests are responded to within 15 (fifteen) calendar days, as provided by the LGPD. In some cases, we may ask you to confirm your identity before processing the request.

10 International Data Transfers

Some of the service providers and game suppliers with which 56xcom partners with may be located outside Brazil. When this occurs, international data transfers are carried out only where the destination country offers an adequate level of personal data protection or where specific contractual safeguards have been put in place.

The safeguards used by 56xcom in international transfers include:

• Standard contractual clauses that impose on the recipient obligations equivalent to those under the LGPD;
• Prior assessment of the data protection level in the destination country;
• Data minimization in transfers — only the information strictly necessary to provide the service is shared with international providers.

The 56xcom does not carry out international data transfers for any purpose not directly related to the operation of the platform and the provision of its services to users in Brazil.

11 Minors

The services of 56xcom are intended exclusively for individuals aged 18 (eighteen) or older. The platform does not knowingly collect personal data from minors.

During registration, the user confirms they have reached the legal age. The 56xcom verifies date of birth and may request documentary proof of age at any time. If an account is found to have been created by a user under 18, it will be immediately closed, the personal data will be deleted within the legal timeframe, and any remaining balance will be refunded to the original payment method.

If you are the guardian of a minor and suspect they have created an account on 56xcom, please contact us immediately at suporte@56xcom.best or via live chat so we can take the necessary steps.

12 Changes to This Privacy Policy

The 56xcom may update this Privacy Policy periodically to reflect changes in Brazilian legislation, data processing practices, or the services offered. Any material change will be communicated to users at least 15 (fifteen) days in advance via email and an in-platform notice.

The date of the last update and the version number are indicated at the top of this document. We recommend reviewing this Policy periodically to stay informed about how 56xcom protects your information.

Your continued use of the platform after a new version of this Policy is published constitutes acceptance of the changes. If you do not agree with the updates, you may request account closure at no additional cost, as described in the Terms and Conditions.

13 Contact, DPO & Support Channels

To exercise your rights as a data subject, report a privacy incident, request clarification about this Policy, or contact the data protection officer (DPO) of 56xcom, use the channels below:

• DPO Email: privacidade@56xcom.best — a channel dedicated exclusively to privacy and data protection matters;
• General support: suporte@56xcom.best — for general questions about the platform, your account, and transactions;
• Live chat: available 24 hours a day, 7 days a week, directly on the 56xcom.best platform;
• National Data Protection Authority (ANPD): if you believe your rights have not been properly addressed by 56xcom, you may file a complaint directly with the ANPD at gov.br/anpd.

The response period for data subject rights requests is up to 15 (fifteen) calendar days from receipt. In cases of high complexity, this period may be extended once by the same amount of time, with a justified notice sent to the requestor.