Privacy Policy aa66 – How We Protect Your Data

The controller of personal data collected and processed in connection with the use of the aa66 platform is the operating company of the site aa66-khelo.com. For the purposes of this Privacy Policy, references to "aa66," "we," or "the platform" refer to the entity responsible for decisions about the processing of your data.

Aa66 has appointed a Data Protection Officer (DPO), responsible for receiving communications from data subjects and for liaising with the National Data Protection Authority (ANPD). The DPO's contact details are available in Section 12 of this document.

Aa66 collects personal data exclusively for legitimate purposes that are necessary for the platform to function. Collection is proportionate — we only ask for what we need to fulfill each specific purpose. See below for the categories of data processed and how each one reaches us:

We do not collect sensitive data such as health information, sexual orientation, religious beliefs, or biometric data. CPF is treated as personal data and stored with specific protections, as required by applicable Brazilian law.

Every piece of data collected by aa66 has a specific, documented purpose. There is no precautionary collection or storage for undefined future uses. Below are the purposes for which your personal data is used:

• Account creation and management: Your name, CPF, email, and phone number are required to create and maintain your aa66 account, including login, password recovery, and profile updates.
• Financial transaction processing: Financial data is used to process deposits via Pix, boleto, credit/debit card, PicPay, Mercado Pago, and TED, and to process withdrawals to your bank account or Pix key.
• Identity verification (KYC): A government-issued ID and proof of address are requested to verify the account holder's identity and prevent fraud, particularly for withdrawals above certain amounts.
• Fraud prevention and anti-money laundering: Transaction history and behavioral patterns are automatically monitored to detect suspicious activity and to fulfill Brazil's regulatory anti-money laundering (AML) obligations.
• Customer support: Customer service records are retained to ensure continuity of support history and to improve the quality of aa66's Portuguese-language support.
• Responsible gambling: Gameplay behavior and frequency data are analyzed to identify concerning patterns and, where applicable, to proactively trigger responsible gambling tools or outreach from our specialist team.
• Platform improvements: Browsing and usage data are analyzed in aggregate and anonymized form to understand how players use aa66 and to prioritize improvements to the interface, performance, and new features.
• Service communications: Email and mobile number are used for essential communications such as deposit confirmations, withdrawal notifications, security alerts, and important account updates.
• Marketing communications (with consent): With your explicit consent, we may send you information about aa66 promotions, bonuses, and updates. You can withdraw that consent at any time from your account dashboard or by clicking "unsubscribe" in any communication you receive.

Aa66 does not sell your personal data. Full stop. Any sharing with third parties occurs only in the situations below, always limited to the minimum data necessary for each purpose:

• Payment providers: Data required to process transactions via Pix (Banco Central), credit/debit card (card networks), PicPay, Mercado Pago, and TED transfers (Nubank, Itaú, Bradesco, Banco do Brasil). We share only what each processor needs to complete the transaction.
• Game providers: Slots, Live Casino, and crash game providers (such as Pragmatic Play, NetEnt, and Spribe) receive a session identifier to authenticate gameplay — they have no access to full personal data such as CPF or address.
• Competent authorities: When required by law, court order, or request from Brazilian regulatory authorities, we may be compelled to share specific information. Such situations are documented and, where legally permitted, communicated to the data subject.
• Technology infrastructure providers: Hosting, database, and security service providers that operate the aa66 platform have technical access to data under strict data processing agreements, with no right to use that information for their own purposes.

Protecting aa66 players' data involves multiple layers of technical and organizational security. The following are the key measures currently in place:

• Encryption in transit: All data transmitted between your device and aa66's servers is encrypted with TLS 1.3 / SSL 256-bit, preventing interception by third parties.
• Encryption at rest: Sensitive data such as CPF, payment information, and identity documents are stored encrypted on our servers, rendering them unreadable even in the event of unauthorized physical access.
• Access control: Only staff with a verified operational need have access to identifiable personal data, with mandatory multi-factor authentication and a full audit log of every access.
• Continuous monitoring: aa66's systems are monitored around the clock to detect unauthorized access attempts, malicious code injection, and other security threats.
• Periodic testing: The platform undergoes regular security assessments, including penetration testing and vulnerability reviews, conducted by specialist teams.

The servers where aa66 player data is stored are located in data centers with recognized physical and operational security certifications. Encrypted backups are performed on a regular basis to ensure data availability and integrity even in the event of a technical failure.

Aa66 retains your personal data for as long as necessary for each specific purpose, in compliance with mandatory legal retention periods in Brazil. See the criteria that determine how long each category of data is kept:

• Active account data: Retained for as long as the account remains active. After voluntary closure, identification data is kept for up to 5 years to meet legal and regulatory obligations.
• Financial records: Deposit and withdrawal transactions (including Pix, card, and wire transfers) are retained for up to 10 years, as required by Brazilian tax and anti-money laundering legislation.
• KYC documents: Identity documents and proof of residence submitted for verification are retained for up to 5 years after account closure, in accordance with regulatory requirements.
• Support records: Live chat conversations and support emails are retained for 2 years for quality assurance and potential dispute resolution purposes.
• Anonymized browsing data: Anonymized access logs are retained for up to 12 months for platform performance analysis.

The General Data Protection Law (LGPD — Lei 13.709/2018) guarantees you, as the holder of personal data processed by aa66, a set of rights that can be exercised at any time. aa66 is committed to responding to all requests within 15 business days.

See below all the rights you can exercise and how to submit each request:

• Access: Request a copy of all personal data aa66 holds about you, including the purposes for which it is processed and with whom it has been shared.
• Correction: Request an update to any outdated or incorrect information — such as a change of address, name correction, or contact update.
• Anonymization, blocking, or deletion: Request that data which is unnecessary, excessive, or processed in violation of the LGPD be anonymized, blocked, or deleted.
• Portability: Receive your data in a structured, machine-readable format for transfer to another controller, where technically feasible.
• Consent withdrawal: Withdraw at any time the consent given for marketing communications or other consent-based processing, without affecting your account or essential services.
• Information on non-consent: Request information about the consequences of withholding consent for a specific processing activity before making your decision.
• Opposition: Object to data processing carried out without your consent, where no overriding legitimate legal basis exists.

To exercise any of these rights, contact us via aa66's live chat (available 24 hours in Portuguese), by email at suporte@aa66-khelo.com, or directly through your account settings panel under the Privacy section.

Aa66 uses cookies and similar technologies to ensure the platform works correctly, personalize the player experience, and analyze site performance. Below you will find the types of cookies we use and their purpose:

• Essential cookies: Required for the platform's core functionality — they keep your session active after login, remember your language preferences, and secure your transactions. These cannot be disabled, as they are essential for using aa66.
• Performance cookies: These collect anonymous information about how pages are used — which sections are visited most, where technical errors occur, and page load times. This data is used exclusively to improve the platform.
• Preference cookies: Remembers personalized settings such as preferred odds, favorite markets, and live betting preferences to tailor your aa66 experience.
• Security cookies: Used to detect suspicious logins and fraud attempts, and to verify that each session is initiated by the legitimate account holder.

Aa66 does not use third-party tracking cookies for behavioral advertising. You can manage your cookie preferences in the banner shown on your first visit, or at any time through your browser settings. Disabling essential cookies may affect the platform's proper functionality.

Aa66 is a platform exclusively for users aged 18 and over, and takes active measures to prevent registration and use by minors. We do not knowingly collect any personal data from individuals under 18.

If we determine that an account was created by a minor — whether through inconsistencies in the information provided, a report, or automated detection — the account will be immediately closed and all data related to the minor will be deleted from our systems within 48 hours. Any real-money balance deposited by a minor will be refunded to the original payment method after verification.

Some of the technology infrastructure providers aa66 uses to operate the platform may have servers located outside Brazil. When this occurs, we ensure that international data transfers are carried out with appropriate safeguards, in accordance with the LGPD and international best practices for data protection.

The safeguards in place include standard contractual clauses that require international recipients to provide a level of protection equivalent to the LGPD, along with a preference for providers located in countries whose data protection legislation has been recognized as adequate by the ANPD.

Aa66 does not transfer data internationally to countries or territories that do not offer adequate protection guarantees, and we document each international transfer with the corresponding legal basis as required by the LGPD.

This Privacy Policy may be updated by aa66 to reflect changes in Brazilian data protection law, changes to the services offered, or improvements to our privacy practices. The date of the last update is always shown at the top of this document.

When changes are significant — such as new types of data being collected, new processing purposes, or new third-party sharing — we will notify active account holders by email at least 15 days before the changes take effect.

Minor changes — such as wording updates, typographical corrections, or clarifications that do not alter the substance of the Policy — take effect immediately upon publication. Continued use of the platform following significant changes constitutes acceptance of the updated Policy.

To exercise your rights under the LGPD, ask questions about this Privacy Policy, report a security incident, or raise any other issue related to the processing of your personal data by aa66, please use the channels below:

• Live chat: Available 24/7, directly on the aa66 platform. This is the fastest channel for resolving straightforward privacy questions.
• General email: suporte@aa66-khelo.com — for general privacy requests, with a response time of up to 5 business days.
• DPO channel: For formal requests to exercise LGPD rights (access, correction, deletion, portability), send an email to suporte@aa66-khelo.com with the subject line "LGPD Request – [your right]". Responses are provided within up to 15 business days, as required by Lei 13.709/2018.

Any request related to personal data can be submitted in Portuguese — our team and our DPO communicate and respond in Brazilian Portuguese. There's no bureaucracy or complicated forms: simply send your request describing what you need along with your identification details so we can verify ownership before processing.

If you believe aa66 has not adequately addressed a request related to your data privacy, you have the right to file a complaint directly with the National Data Protection Authority (ANPD) through its official website.